CVE-2020-25671: Linux Kernel Privilege Escalation Flaw

CVE-2020-25671 Overview

CVE-2020-25671 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Near Field Communication Logical Link Control Protocol (NFC LLCP) implementation. A reference count leak in the llcp_sock_connect() function leaves a socket object accessible after release. A local, authenticated attacker can trigger the freed object reuse to corrupt kernel memory and escalate privileges to root.

The flaw affects the upstream Linux kernel and downstream distributions including Debian, Fedora, and multiple NetApp HCI and SolidFire firmware images that ship the affected kernel.

Critical Impact
Local privilege escalation to kernel context with full confidentiality, integrity, and availability impact on affected Linux systems.

Affected Products

Linux Kernel (multiple versions prior to fix)
Fedora 32, 33, and 34
Debian Linux 9.0
NetApp HCI (H300S/H500S/H700S/H410S/H300E/H500E/H700E/H410C), SolidFire BMC firmware, Active IQ Unified Manager for VMware vSphere, and Cloud Backup

Discovery Timeline

2020-11-01 - Issue reported on the OpenWall oss-security mailing list
2021-05-26 - CVE-2020-25671 published to NVD
2021-06 - Debian LTS advisories released addressing the flaw
2021-07-02 - NetApp publishes advisory NTAP-20210702-0008
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-25671

Vulnerability Analysis

The vulnerability resides in the NFC LLCP socket implementation in net/nfc/llcp_sock.c. The llcp_sock_connect() function performs reference counting on the underlying nfc_llcp_local object during connection setup. Under specific error paths, the reference counter is incremented without a corresponding decrement, while in other paths a referenced object is released even though it is still tracked.

This imbalance produces a use-after-free condition: kernel code paths continue to dereference the nfc_llcp_local structure after its backing memory has been freed and potentially reallocated. Because LLCP socket objects are reachable from unprivileged user space through the AF_NFC socket family, a local user can drive the kernel into the vulnerable state.

Root Cause

The root cause is improper reference count management around socket connection error handling. The fix balances the nfc_llcp_local_get() and nfc_llcp_local_put() calls so that the local LLCP state is only released once the socket and all consumers have dropped their references. The bug class is classic CWE-416, use-after-free in kernel network protocol code.

Attack Vector

Exploitation requires local code execution with the ability to create AF_NFC sockets. An attacker repeatedly invokes connect() on an NFC LLCP socket along paths that trigger the refcount leak, then races allocation primitives to place attacker-controlled data into the freed slab object. Subsequent kernel access to the dangling pointer can be redirected to corrupt function pointers or credentials structures, yielding kernel-mode execution and privilege escalation to root.

No public proof-of-concept exploit is referenced in the advisory data, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the OpenWall security list entry for the original disclosure thread.

Detection Methods for CVE-2020-25671

Indicators of Compromise

Unexpected kernel oops or general protection fault entries in dmesg or /var/log/kern.log referencing llcp_sock_connect, nfc_llcp_local, or nfc_llcp symbols.
KASAN reports (on instrumented kernels) flagging use-after-free reads or writes inside the NFC LLCP subsystem.
Unexpected processes loading the nfc or nfc_llcp kernel modules on systems that do not use NFC hardware.

Detection Strategies

Inventory running kernel versions across Linux hosts and compare against patched versions shipped in the Debian, Fedora, and NetApp advisories.
Audit auditd or eBPF telemetry for socket(AF_NFC, ...) calls originating from non-administrative processes, which is anomalous in most server environments.
Monitor for unsigned or unexpected kernel module loads, specifically nfc.ko and llcp.ko, using modprobe and kmod auditing rules.

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized SIEM and alert on crash signatures within NFC code paths.
Track sudden increases in kernel panic rates or process crashes on hosts where NFC sockets are not part of normal workload.
Correlate local user activity preceding kernel faults to identify potential exploitation attempts on multi-user systems.

How to Mitigate CVE-2020-25671

Immediate Actions Required

Apply vendor kernel updates from Debian, Fedora, NetApp, or the upstream Linux kernel tree on every affected host.
Reboot patched systems to load the fixed kernel image; livepatch is acceptable where supported.
Restrict local shell access on multi-tenant systems until patching is complete, since exploitation requires local code execution.

Patch Information

Patched kernel packages are available through distribution channels. Reference the Debian LTS advisory (DLA msg00019), Debian LTS advisory (DLA msg00020), the Fedora package announcements (FEDORA-PW3OASG7, FEDORA-UTVACC6P, FEDORA-VEIEGQXU), and the NetApp Security Advisory NTAP-20210702-0008.

Workarounds

Blacklist the nfc and nfc_llcp kernel modules on systems that do not require NFC functionality by adding install nfc /bin/true to /etc/modprobe.d/.
Remove CAP_NET_RAW and restrict AF_NFC socket creation via seccomp profiles for untrusted workloads and container runtimes.
Enforce least-privilege shell access and disable interactive logins for service accounts to remove the local-attacker prerequisite.

bash

# Blacklist the vulnerable NFC LLCP modules on hosts that do not use NFC
echo "blacklist nfc"      | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo "blacklist nfc_llcp" | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf
echo "install nfc /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf

# Unload modules if currently loaded
sudo rmmod nfc_llcp 2>/dev/null
sudo rmmod nfc      2>/dev/null

# Confirm patched kernel is running after update and reboot
uname -r