CVE-2020-25673: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-25673 is a vulnerability discovered in the Linux kernel's NFC LLCP protocol implementation, specifically in the llcp_sock_connect() function. The vulnerability was discovered by Kiyin (尹亮) and disclosed on November 1, 2020. The issue affects Linux kernel versions prior to 5.3.18, where a non-blocking socket in llcp_sock_connect() leads to resource leaks and potential system hang-ups (OSS Security).

The vulnerability occurs in the NFC socket implementation where calling llcp_sock_connect() with a non-blocking socket can lead to multiple issues. When a non-blocking socket is used and llcp_sock_connect() is called with a meaningless service_name, the connection fails but leaves sk->sk_state in a non-LLCP_CONNECTED state. This allows multiple calls to llcp_sock_connect(), resulting in resource leaks including llcp_sock->dev, llcp_sock->local, llcp_sock->ssap, and llcp_sock->service_name. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The primary impact of this vulnerability is a potential Denial of Service (DoS) condition. When exploited, the vulnerability can cause the system to hang up due to an endless loop created when nfc_llcp_sock_link() adds the same socket to local->connecting_sockets twice, causing sk->sk_node->next to point to itself. Additionally, the vulnerability results in resource leaks that can degrade system performance (OSS Security, NetApp Advisory).

The vulnerability requires local access with low privileges to exploit. A proof-of-concept exploit has been publicly disclosed that demonstrates how the vulnerability can be triggered using a specially crafted socket operation. The exploit involves setting up a non-blocking NFC socket and repeatedly calling llcp_sock_connect() with specific parameters to trigger the resource leak and system hang condition (OSS Security).

The vulnerability has been addressed in Linux kernel version 5.11.4 and later. Multiple Linux distributions have released security updates to patch this vulnerability, including Fedora 32, 33, and 34. Users are advised to update their systems to the patched versions. For Fedora systems, the fix is available in kernel version 5.11.14 (Fedora Update).