CVE-2020-25670

What it actually does

Refcount leak in llcp_sock_bind() causes a use-after-free that can be abused for local privilege escalation.

Why it matters to the business

Local attackers can obtain full system control, risking data theft, persistence, and lateral movement; exploit code is public and the issue remains relevant years after disclosure.

How an attack unfolds

An attacker with local access performs repeated NFC LLCP socket bind operations to trigger the reference-count leak, reclaims the freed socket object, and leverages the dangling reference to execute arbitrary code with elevated privileges.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the llcp_sock_bind refcount leak; for nextcloud/deck apply commit 6a3655a45d1b8c9c05e0613e5f95d76ddc5c2135.

How to confirm the fix worked

Confirm the running kernel version contains the upstream fix, review source for the corrected refcount handling in llcp_sock_bind, and test that repeated bind/unbind sequences no longer produce use-after-free conditions under memory pressure.

Typical attack path

1. Gain local shell access
2. Trigger repeated llcp_sock_bind calls to exhaust the reference count
3. Free the socket object while retaining a reference
4. Reclaim the memory with attacker-controlled data
5. Use the dangling pointer to hijack execution and escalate privileges

How to detect it

Inspect kernel logs and audit records for repeated llcp socket activity followed by crashes or unexpected privilege changes; correlate with process creation events showing escalation from non-root to root.

What your security team should do

• Patch kernels on all affected hosts without delay
• Limit untrusted local accounts and disable NFC/LLCP where unnecessary
• Harden systems with LSMs and kernel hardening features
• Include kernel use-after-free signatures in EDR rules