Vulnerability Description
A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | 5.10 |
| Redhat | Enterprise Linux | 7.0 |
| Redhat | Enterprise Mrg | 2.0 |
| Debian | Debian Linux | 9.0 |
| Netapp | Cloud Backup | - |
| Netapp | Solidfire Baseboard Management Controller Firmware | - |
| Netapp | Solidfire Baseboard Management Controller | - |
| Netapp | H410C Firmware | - |
| Netapp | H410C | - |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1905155Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00018.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210521-0008/Third Party Advisory
- https://www.debian.org/security/2021/dsa-4843Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1905155Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00018.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210521-0008/Third Party Advisory
- https://www.debian.org/security/2021/dsa-4843Third Party Advisory
FAQ
What is CVE-2020-27825?
CVE-2020-27825 is a vulnerability with a CVSS score of 5.7 (MEDIUM). A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, ma...
How severe is CVE-2020-27825?
CVE-2020-27825 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-27825?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Redhat Enterprise Linux, Redhat Enterprise Mrg, Debian Debian Linux, Netapp Cloud Backup.