Read the docs
TI-2020-12376 Aliases CVE-2020-15704GHSA-2q4h-xfv6-4848

pppd arbitrary file read information disclosure vulnerability

Priority LOW 25CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBE_OPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu1.4, 2.4.5-5.1ubuntu2.3+esm2, 2.4.7-1+2ubuntu1.16.04.3, 2.4.7-2+2ubuntu1.3, 2.4.7-2+4.1ubuntu5.1, 2.4.7-2+4.1ubuntu6. Was ZDI-CAN-11504.

Why it matters now

EPSS 0.00364 30th percentileScored 2026-11-07
Fix Fixed ppp (Canonical): 2.4.5-5ubuntu1.4, 2.4.7-1+2ubuntu1.16.04.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalppp2.4.5 to before 2.4.5-5ubuntu1.4; 2.4.7 to before 2.4.7-1+2ubuntu1.16.04.32.4.5-5ubuntu1.4, 2.4.7-1+2ubuntu1.16.04.3Patch availableCNA
  • ppp VendorCanonical Affected 2.4.5 to before 2.4.5-5ubuntu1.4; 2.4.7 to before 2.4.7-1+2ubuntu1.16.04.3 Fixed in 2.4.5-5ubuntu1.4, 2.4.7-1+2ubuntu1.16.04.3 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:*before 2.4.7-1\+ubuntu1.16.04.3VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04Running onCanonical
cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:*before 2.4.7-2\+2ubuntu1.3VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04Running onCanonical
cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:*before 2.4.7-2\+4.1ubuntu5.1VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04Running onCanonical
cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:*before 2.4.5-5ubuntu1.4VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*12.04Running onCanonical
cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:*before 2.4.5-5.1ubuntu2.3\+esm2VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04Running onCanonical
  • cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:* Versions before 2.4.7-1\+ubuntu1.16.04.3 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Running on ·Canonical
  • cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:* Versions before 2.4.7-2\+2ubuntu1.3 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Running on ·Canonical
  • cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:* Versions before 2.4.7-2\+4.1ubuntu5.1 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Running on ·Canonical
  • cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:* Versions before 2.4.5-5ubuntu1.4 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Running on ·Canonical
  • cpe:2.3:a:canonical:ppp:*:*:*:*:*:*:*:* Versions before 2.4.5-5.1ubuntu2.3\+esm2 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Running on ·Canonical

Remediation

  • Fix · CNA ppp (Canonical) Fixed in 2.4.5-5ubuntu1.4, 2.4.7-1+2ubuntu1.16.04.3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15704
  2. 2026-10-03 Alias added: GHSA-2q4h-xfv6-4848

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences