CVE-2020-25285: 
Linux Kernel vulnerability analysis and mitigation

A race condition vulnerability (CVE-2020-25285) was discovered in the hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before version 5.8.8. The vulnerability was identified and fixed in September 2020, affecting various Linux-based systems and distributions (Kernel Changelog, Debian Advisory).

The vulnerability stems from a race condition between the assignment of table->data and writing value to the pointer of table->data in the __do_proc_doulongvec_minmax() function on another thread. This could lead to stack corruption when multiple processes attempt to modify hugepage sysctls simultaneously. The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (MEDIUM) with vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could allow local attackers to corrupt memory, cause a NULL pointer dereference, or potentially have other unspecified impacts. By default, only root users have permission to write to hugepages sysctls, which limits the potential for exploitation (Debian Advisory, Ubuntu Advisory).

The vulnerability requires local access and high privileges to exploit. It specifically affects systems where users have permission to write to hugepages sysctls. The attack complexity is considered high due to the specific timing requirements needed to trigger the race condition (NVD).

The vulnerability was fixed in Linux kernel version 5.8.8 through a patch that duplicates the table and only updates the duplicate to prevent the race condition. Major Linux distributions have released security updates to address this vulnerability, including Ubuntu 20.04 LTS, 18.04 LTS, 16.04 LTS, and Debian 9 (Ubuntu Advisory, Debian Advisory).