Skip to content
OpenAdvisories
Medium USN-4451-1 1 CVE

ppp vulnerability

Published Aug 4, 2020 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Thomas Chauchefoin working with Trend Micro´s Zero Day Initiative,
discovered that ppp incorrectly handled module loading. A local attacker
could use this issue to load arbitrary kernel modules and possibly execute
arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS ppp 2.4.7-1+2ubuntu1.16.04.3
Ubuntu · 18.04 LTS 18.04:LTS ppp 2.4.7-2+2ubuntu1.3
Ubuntu · 20.04 LTS 20.04:LTS ppp 2.4.7-2+4.1ubuntu5.1

Vulnerabilities 1

  • Medium 5.5
    CVE-2020-15704

    pppd arbitrary file read information disclosure vulnerability

    The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBE_OPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu…

    Canonical ppp ppp Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2020-15704