CVE-2020-25582

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-25582
In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 when a process, such as jexec(8) or killall(1), calls jail_attach(2) to enter a jail, the jailed root can attach to it using ptrace(2) before the current working directory is changed.

8.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

8.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:N

Exploitability : 8.0 / Impact : 9.2

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact NONE

References
Link Resource
https://security.FreeBSD.org/advisories/FreeBSD-SA-21:05.jail_chdir.asc Vendor Advisory
https://security.netapp.com/advisory/ntap-20210423-0003/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:freebsd:freebsd:11.4:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p4:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p5:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p6:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p7:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:12.2:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:12.2:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:12.2:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:12.2:p3:*:*:*:*:*:*
History

12 Jul 2022, 17:42

Type Values Removed Values Added
CWE CWE-269 CWE-362

03 Jun 2021, 19:11

Type Values Removed Values Added
References (CONFIRM) https://security.netapp.com/advisory/ntap-20210423-0003/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20210423-0003/ - Third Party Advisory

23 Apr 2021, 06:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20210423-0003/ -

02 Apr 2021, 18:43

Type Values Removed Values Added
CWE CWE-269
CVSS v2 : unknown
v3 : unknown 		v2 : 8.5
v3 : 8.7
References (MISC) https://security.FreeBSD.org/advisories/FreeBSD-SA-21:05.jail_chdir.asc - (MISC) https://security.FreeBSD.org/advisories/FreeBSD-SA-21:05.jail_chdir.asc - Vendor Advisory
CPE cpe:2.3:o:freebsd:freebsd:11.4:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:12.2:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p5:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:12.2:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:12.2:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:12.2:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p7:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p6:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p4:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:11.4:p2:*:*:*:*:*:*

26 Mar 2021, 21:27

Type Values Removed Values Added
New CVE
Information

Published : 2021-03-26 21:15

Updated : 2023-12-10 13:55

NVD link : CVE-2020-25582

Mitre link : CVE-2020-25582

CVE.ORG link : CVE-2020-25582

JSON object : View

Products Affected

freebsd

  • freebsd
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')