CVE-2020-25673 Overview
CVE-2020-25673 is a resource management flaw in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. The defect resides in the llcp_sock_connect() function, where the use of a non-blocking socket can trigger a resource leak. Repeated triggering of this leak exhausts kernel resources and eventually causes the system to hang. The flaw is classified under [CWE-400] (Uncontrolled Resource Consumption) and affects multiple Linux kernel releases, several Fedora versions, and a range of NetApp appliances that ship the affected kernel.
Critical Impact
A local, authenticated user can repeatedly invoke the vulnerable code path to exhaust kernel resources and render the affected host unresponsive, producing a denial-of-service condition.
Affected Products
- Linux Kernel (multiple versions prior to upstream fix)
- Fedora 32, 33, and 34
- NetApp Active IQ Unified Manager, Cloud Backup, SolidFire BMC firmware, and H-Series nodes (H300S/H500S/H700S/H410S/H300E/H500E/H700E/H410C)
Discovery Timeline
- 2021-05-26 - CVE-2020-25673 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2020-25673
Vulnerability Analysis
The vulnerability exists in the NFC LLCP socket connection logic of the Linux kernel. When a user-space process opens an LLCP socket in non-blocking mode and calls connect(), the llcp_sock_connect() function fails to release allocated resources along the non-blocking error path. Each invocation leaks kernel memory and socket state structures. An attacker who can issue NFC socket calls can repeat this operation in a tight loop and gradually consume available kernel resources until the system can no longer service new requests and hangs.
The issue requires local access and low-privileged authenticated context, but no user interaction. Successful exploitation produces a high-impact availability outcome without affecting confidentiality or integrity. The flaw aligns with [CWE-400] Uncontrolled Resource Consumption.
Root Cause
The root cause is missing cleanup logic in llcp_sock_connect() when the underlying socket is configured as non-blocking. The function allocates internal state and references before returning -EINPROGRESS to user space, but does not unwind those allocations on subsequent error or retry paths. Repeated entry into the function therefore accumulates orphaned kernel objects.
Attack Vector
The attack vector is local. An attacker with the ability to execute code on the system and open NFC LLCP sockets writes a small program that:
- Creates an AF_NFC socket of type SOCK_STREAM with the LLCP protocol.
- Sets the socket to non-blocking mode using fcntl() with O_NONBLOCK.
- Calls connect() against an LLCP address in a loop.
Each iteration leaks kernel resources. Sustained execution leads to memory exhaustion and a system hang. See the OpenWall oss-security disclosure for technical discussion of the defect.
Detection Methods for CVE-2020-25673
Indicators of Compromise
- Sustained growth of kernel slab allocations associated with NFC and LLCP socket structures without corresponding releases.
- Unprivileged processes repeatedly invoking socket(AF_NFC, ...) followed by non-blocking connect() calls.
- Progressive degradation of system responsiveness culminating in an unresponsive host running an unpatched kernel.
Detection Strategies
- Monitor /proc/slabinfo for unusual growth of NFC-related caches on Linux hosts where NFC is not actively used.
- Audit execve and syscall telemetry for processes creating AF_NFC sockets, especially in server environments where NFC is not expected.
- Correlate kernel OOM events and soft lockup messages in dmesg with the presence of unpatched kernels listed in vendor advisories.
Monitoring Recommendations
- Enable auditd rules that log socket() syscalls with the AF_NFC family and review aggregated counts per user and host.
- Track kernel memory consumption baselines and alert on sustained upward drift on production Linux systems.
- Subscribe to the NetApp NTAP-20210702-0008 advisory and Fedora package-announce lists for fixed-version notifications.
How to Mitigate CVE-2020-25673
Immediate Actions Required
- Update the Linux kernel to a version that includes the upstream fix to llcp_sock_connect() resource handling.
- Apply Fedora updates referenced in the Fedora package-announce notifications for Fedora 32, 33, and 34.
- Apply firmware and software updates for affected NetApp products per NetApp NTAP-20210702-0008.
- Restrict local access on multi-tenant Linux systems where patching cannot occur immediately.
Patch Information
The Linux kernel maintainers corrected the resource leak in llcp_sock_connect() and distributions integrated the fix into stable updates. Refer to the OpenWall security list post for the upstream discussion and to the Fedora package-announce messages (FEDORA-2020-PW3OASG7OE, FEDORA-2020-UTVACC6PGS, FEDORA-2020-VEIEGQXUW3) for fixed package builds.
Workarounds
- Blacklist the nfc and llcp kernel modules on systems that do not require NFC functionality.
- Restrict access to NFC sockets through Linux capabilities, seccomp filters, or LSM policies that deny the AF_NFC socket family to untrusted users.
- Limit local user accounts on affected hosts and apply resource limits via ulimit and cgroups to slow the rate of resource exhaustion.
# Blacklist NFC kernel modules to remove the vulnerable code path
echo "blacklist nfc" | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo "blacklist nfc_llcp" | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf
# Prevent on-demand module loading
sudo update-initramfs -u
# Verify the module is not loaded
lsmod | grep -E "nfc|llcp"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
