一、漏洞信息

漏洞编号：[CVE-2020-25212](https://nvd.nist.gov/vuln/detail/CVE-2020-25212)

CVSS V3.0分值：

BaseScore：7.0 High

Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

漏洞简述：

A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.

漏洞创建时间：2020-10-30 15:56:10

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2020-25212

一、漏洞信息

漏洞编号：[CVE-2020-25212](https://nvd.nist.gov/vuln/detail/CVE-2020-25212)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.90,before5.8.3

CVSS V3.0分值：

BaseScore：7.0 High

Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

漏洞简述：

A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.

漏洞公开时间：2020-09-10 00:15

漏洞创建时间：2020-10-30 15:56:10

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2020-25212

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cdn | https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.3 | |

| git | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b4487b93545214a9db8cbf32e86411677b0cca21 | |

| twitter | https://twitter.com/grsecurity/status/1303370421958578179 | |

| usn | https://usn.ubuntu.com/4527-1/ | |

| usn | https://usn.ubuntu.com/4525-1/ | |

| lists | https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html | |

| lists | http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html | |

| usn | https://usn.ubuntu.com/4578-1/ | |

| lists | http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00035.html | |

| lists | http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00042.html | |

| lists | https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html | |

| lists | https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html | |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

7.0

Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

一、漏洞信息

漏洞编号：[CVE-2020-25212](https://nvd.nist.gov/vuln/detail/CVE-2020-25212)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.90,before5.8.3

CVSS V3.0分值：

BaseScore：7.0 High

Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

漏洞简述：

A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.

漏洞公开时间：2020-09-10 00:15

漏洞创建时间：2020-10-30 15:56:10

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2020-25212

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cdn | https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.3 | |

| git | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b4487b93545214a9db8cbf32e86411677b0cca21 | |

| twitter | https://twitter.com/grsecurity/status/1303370421958578179 | |

| usn | https://usn.ubuntu.com/4527-1/ | |

| usn | https://usn.ubuntu.com/4525-1/ | |

| lists | https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html | |

| lists | http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html | |

| usn | https://usn.ubuntu.com/4578-1/ | |

| lists | http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00035.html | |

| lists | http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00042.html | |

| lists | https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html | |

| lists | https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html | |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

7.0

Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):