CVE-2020-25704

MEDIUM

Linux Kernel < 5.9 - Memory Leak

Title source: rule

Description

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.

References (6)

[Issue Tracking, Third Party Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=1895961

[Patch, Vendor Advisory] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7bdb157cdebbf95a1cd94ed2e01b338714075d00

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html

[Mailing List] https://www.openwall.com/lists/oss-security/2020/11/09/1

[Third Party Advisory] https://www.starwindsoftware.com/security/sw-20220802-0003/

Scores

CVSS v3 5.5

EPSS 0.0002

EPSS Percentile 6.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-401

Status published

Affected Products (8)

linux/linux_kernel < 5.9

linux/linux_kernel

debian/debian_linux

starwindsoftware/command_center

starwindsoftware/starwind_hyperconverged_appliance

starwindsoftware/starwind_san_\&_nas

starwindsoftware/starwind_virtual_san

Timeline

Published Dec 02, 2020

Tracked Since Feb 18, 2026