Vulnerability in Red Hat Kernel
CVE-2020-25662
A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.012 (66.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 67th percentile — 66.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- Red Hat Kernel — versions kernel-4.18.0-240.el8
- Red Hat Enterprise Linux — versions 8.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- access.redhat.com/security/vulnerabilities/BleedingTooth (Vendor Advisory)
- bugzilla.redhat.com/show_bug.cgi (Mitigation, Issue Tracking, Vendor Advisory)
- access.redhat.com/security/cve/CVE-2020-12352 (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-25662?
- CVE-2020-25662 is a medium-severity vulnerability in Red Hat Kernel, classified under Improper Access Control. CVSS score: 5.3/10. Published 2020-11-05.
- How severe is CVE-2020-25662?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2020-25662 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.