CVE-2020-25673: Linux Kernel DOS Vulnerability

CVE-2020-25673 Overview

A memory leak vulnerability was discovered in the Linux kernel's NFC (Near Field Communication) subsystem, specifically within the llcp_sock_connect() function. When a non-blocking socket connection is attempted, the kernel fails to properly release allocated memory resources, resulting in a gradual memory leak that can eventually cause the system to hang or become unresponsive.

Critical Impact

Local attackers with low privileges can exploit this vulnerability to cause a denial of service condition by exhausting system memory through repeated connection attempts using non-blocking NFC LLCP sockets.

Affected Products

• Linux Kernel (multiple versions)
• Fedora 32, 33, and 34
• NetApp Active IQ Unified Manager (vSphere)
• NetApp Cloud Backup
• NetApp SolidFire Baseboard Management Controller
• NetApp H410c, H300s, H500s, H700s, H300e, H500e, H700e, and H410s series hardware

Discovery Timeline

• 2020-11-01 - Vulnerability disclosed via Openwall OSS Security mailing list
• 2021-05-26 - CVE-2020-25673 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-25673

Vulnerability Analysis

This vulnerability exists in the Linux kernel's NFC LLCP (Logical Link Control Protocol) socket implementation. The flaw occurs when the llcp_sock_connect() function handles non-blocking socket connections. Under normal operation, when a socket connection is established, the kernel allocates memory for connection state management. However, when using non-blocking mode, the function fails to properly deallocate these resources when the connection attempt returns immediately without completing.

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), as repeated exploitation leads to progressive memory exhaustion. A local attacker with low-level privileges can trigger this condition by repeatedly initiating non-blocking NFC LLCP socket connections, causing the kernel to leak memory with each attempt until system resources are depleted.

Root Cause

The root cause lies in improper resource management within the llcp_sock_connect() function. When a socket is configured for non-blocking operation and a connection is initiated, the function allocates internal data structures but fails to release them when the operation returns with an -EINPROGRESS status. This creates an orphaned memory allocation that cannot be reclaimed by the kernel's memory management subsystem.

Attack Vector

The attack requires local access to the system with low privileges. An attacker can exploit this vulnerability by:

1. Creating an NFC LLCP socket using the socket() system call
2. Configuring the socket for non-blocking operation using fcntl() with O_NONBLOCK
3. Repeatedly calling connect() on the socket to trigger the memory leak
4. Continuing the process until system memory is exhausted, causing denial of service

The vulnerability mechanism involves improper cleanup of LLCP connection context structures when non-blocking sockets fail to complete their connection handshake. Each failed connection attempt leaves behind allocated memory that accumulates over time, eventually leading to system instability or a complete system hang.

Detection Methods for CVE-2020-25673

Indicators of Compromise

• Unusual memory consumption patterns in kernel space without corresponding user-space activity
• Gradual increase in kernel memory usage related to NFC subsystem allocations
• System slowdown or unresponsiveness following NFC-related socket operations
• Kernel log messages indicating memory allocation failures or OOM (Out of Memory) conditions

Detection Strategies

• Monitor system memory utilization trends, particularly kernel slab allocations related to NFC components
• Implement auditd rules to track socket() system calls with the NFC protocol family (AF_NFC)
• Deploy SentinelOne Singularity Platform to detect anomalous kernel behavior and resource exhaustion patterns
• Review kernel logs for LLCP-related warnings or memory pressure indicators

Monitoring Recommendations

• Enable kernel memory debugging options to track slab allocations in test environments
• Configure alerts for sustained memory growth without corresponding legitimate workload increases
• Monitor NFC subsystem activity on systems where NFC functionality is not expected or required
• Utilize SentinelOne's behavioral detection capabilities to identify denial of service attack patterns

How to Mitigate CVE-2020-25673

Immediate Actions Required

• Update the Linux kernel to a patched version that addresses the memory leak in llcp_sock_connect()
• Disable NFC functionality if not required by business operations using kernel module blacklisting
• Apply vendor-specific patches from Fedora, NetApp, and other affected vendors
• Implement resource limits using cgroups to contain potential memory exhaustion attacks

Patch Information

Security patches addressing this vulnerability have been released through various distribution channels. Administrators should consult the following resources for updated packages:

• Openwall OSS Security Advisory for initial disclosure and technical details
• Fedora Package Announcements for Fedora-specific updates
• NetApp Security Advisory NTAP-20210702-0008 for NetApp product updates

Workarounds

• Blacklist the NFC kernel modules by adding blacklist nfc and blacklist llcp to /etc/modprobe.d/blacklist.conf
• Restrict access to NFC devices using udev rules to limit which users can interact with NFC hardware
• Implement mandatory access control policies (SELinux/AppArmor) to prevent unauthorized socket creation

# Disable NFC kernel modules
echo "blacklist nfc" >> /etc/modprobe.d/blacklist-nfc.conf
echo "blacklist llcp" >> /etc/modprobe.d/blacklist-nfc.conf
echo "install nfc /bin/false" >> /etc/modprobe.d/blacklist-nfc.conf
echo "install llcp /bin/false" >> /etc/modprobe.d/blacklist-nfc.conf

# Apply changes without reboot (if modules not currently loaded)
depmod -a

# Verify modules are blacklisted
modprobe -n -v nfc