Vulnerability in Red Hat Kernel
CVE-2020-25662
A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality.
EPSS: 0.012 (64.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Red Hat Kernel — versions kernel-4.18.0-240.el8
- Redhat Enterprise_linux — versions 8.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (Vendor Advisory)
- secalert@redhat.com (Mitigation, Issue Tracking, Vendor Advisory)
- secalert@redhat.com (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-25662?
- CVE-2020-25662 is a medium-severity vulnerability in Red Hat Kernel, classified under Improper Access Control. CVSS score: 5.3/10. Published 2020-11-05.
- How severe is CVE-2020-25662?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2020-25662 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.