CVE-2020-25221: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-25221 is a privilege escalation vulnerability discovered in the Linux kernel versions 5.7.x and 5.8.x before 5.8.7. The vulnerability exists in the get_gate_page function in mm/gup.c due to incorrect reference counting caused by gate page mishandling of the struct page that backs the vsyscall page. The issue was discovered in September 2020 and affects 64-bit processes that can use ptrace() or process_vm_readv() (Kernel Changelog, OSS Security).

The vulnerability stems from a mismatch between pin_user_pages() and get_user_pages() interfaces for manipulating page reference counts. While 'pins' use a 'bias' value and manipulate the reference count by 1024, 'gets' use a value of 1. The get_gate_page() function uses try_get_page() which only increases the refcount by 1, even when called in the pin_user_pages() path. This leads to a refcount underflow when unpin_user_pages() later attempts to subtract 1024 from the reference count (Kernel Patch). The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to privilege escalation, disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability affects any 64-bit process with permissions to use ptrace() or process_vm_readv() functions (NetApp Advisory).

The vulnerability can be triggered by any 64-bit process that has permission to use ptrace() or process_vm_readv(). A creative attacker could potentially achieve kernel code escalation by exploiting this bug. The issue is reliably and quickly reproducible when running x86 selftests with vsyscall=emulate enabled, which is the default configuration (OSS Security).

The vulnerability was fixed in Linux kernel version 5.8.7. As temporary workarounds, systems can be booted with vsyscall=xonly or vsyscall=none to prevent the issue from triggering. Additionally, running the updated test case can effectively hotpatch a kernel with suitable hardening options by underflowing the refcount past zero, preventing further use of the page (OSS Security).