Loading vulnerability…
CVE-2020-25705 is a weakness in the Linux kernel's global ICMP reply rate-limiting behavior. A predictable, globally shared rate-limit counter creates an off-path side channel: an attacker can induce and observe rate-limit effects to infer whether a UDP port, including an ephemeral source port selected by a DNS resolver, is in use. This undermines UDP source-port randomization, which is relied upon as entropy for transaction matching by DNS and other UDP-based services.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept exploit for CVE-2020-25705 (SAD DNS), a vulnerability in the Linux kernel's handling of ICMP error messages that can be leveraged for DNS cache poisoning attacks. The main exploit script, 'cve-2020-25705.py', is written in Python and uses the Scapy library to craft and send UDP and DNS packets. The exploit works by identifying open UDP ports on the victim (an Ubuntu Server is referenced), then sending spoofed DNS replies to poison the DNS cache for a chosen domain (e.g., www.example.com) with an attacker-controlled IP address. The script is incomplete and contains pseudocode and comments outlining the attack logic, but the core methodology and attack flow are clearly described. The repository also includes a README and a BSD license file. No hardcoded IP addresses or domains are present; instead, variables are used for the victim, resolver, and poison IPs, as well as the target domain. The exploit demonstrates the feasibility of the attack but would require further development to be fully operational.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel ICMP rate-limiting vulnerability that can enable a DNS-poisoning attack, remediated in the Red Hat Enterprise Linux 7.6 kernel update.
A Linux kernel ICMP rate-limiting weakness that can be used to facilitate DNS poisoning attacks.
A Linux kernel vulnerability in which ICMP rate limiting can be used to facilitate DNS cache-poisoning attacks.
A Linux kernel ICMP rate-limiting vulnerability that can be used to facilitate DNS cache-poisoning attacks.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.