CVE-2020-35519

What it actually does

Out-of-bounds memory access in the x25_bind function of the Linux kernel X.25 implementation allows a local user to read or write kernel memory beyond allocated bounds, resulting in information disclosure or denial of service via system crash.

Why it matters to the business

Local accounts on affected Linux systems can cause unplanned outages or exposure of internal kernel data, increasing risk in multi-user or shared environments; the issue has remained unexploited in the wild for years with no active ransomware usage.

How an attack unfolds

An attacker with a local user account on a vulnerable Linux system invokes the x25_bind system call with crafted parameters that bypass the insufficient bounds check, directly accessing adjacent kernel memory structures to leak data or trigger a panic.

How to fix it

Upgrade the Linux kernel to a version containing the bounds check fix for x25_bind (post v5.12-rc5); apply vendor patches for all listed NetApp products; disable the X.25 module if unused via kernel configuration or blacklisting.

How to confirm the fix worked

Verify running kernel version is newer than the vulnerable release and confirm the presence of the upstream bounds-check patch in net/x25/af_x25.c; test that x25_bind calls with invalid parameters no longer cause OOB access or crashes.

Typical attack path

1. Obtain a local user account on the target Linux system
2. Load or interact with the X.25 protocol stack if not already enabled
3. Invoke x25_bind with out-of-bounds parameters to trigger memory access
4. Read leaked kernel memory or force a system crash for denial of service

How to detect it

Review system logs for kernel oops or panic entries mentioning x25_bind or af_x25; inspect for unexpected process crashes or memory-related kernel warnings on systems exposing the X.25 stack; no public exploit artifacts are known.

What your security team should do

• Apply kernel and NetApp firmware updates as soon as possible on internet-facing or multi-user systems
• Restrict local account creation and limit use of legacy protocols such as X.25
• Monitor for kernel oops or panic logs referencing x25_bind
• Reassess need for X.25 support and remove the module where feasible