CVE-2020-8649: Use After Free

Q: Who is realistically exposed to this issue?

Systems that provide a local VGA console are exposed, particularly where an attacker can obtain local physical access to a virtual console. The listed affected software includes Linux kernel packages from Red Hat, Debian, and openSUSE Leap.

Q: What does an attacker need to do to trigger the flaw?

The attacker needs local physical access to a VGA console and the ability to issue a terminal resize request. No user interaction is required, but the CVSS vector indicates low privileges are required.

Q: What is the potential impact of successful exploitation?

The reported behavior can leak information to the local console through an out-of-bounds read. The CVSS vector also rates confidentiality and availability impact as high, while integrity impact is not indicated.

Q: What kernel versions are identified as affected?

The vulnerability is described as present in the Linux kernel through version 5.5.2. No fixed version is provided in the supplied data.

Published Jan 30, 2020

Updated

A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console. An out-of-bounds read can occur, leaking information to the console.

Other sources

A flaw was found in the Linux kernels implementation of VGA local console in the vgaconinvertregion functionality. An attacker with local physical access to a "VGA console" (think local virtual console) who is able to issue a terminal resize request could possibly cause a leak of information to the local console.

Reference: https://bugzilla.kernel.org/showbug.cgi?id=206357 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=513dc792d6060d5ef572e43852683097a8420f56

— Red Hat

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgaconinvertregion function in drivers/video/console/vgacon.c.

Affected Software

11 affected componentsFixes available

redhat/kernel-rt<0:3.10.0-1160.rt56.1131.el7

0:3.10.0-1160.rt56.1131.el7

redhat/kernel<0:3.10.0-1160.el7

0:3.10.0-1160.el7

redhat/kernel-rt<0:4.18.0-240.rt7.54.el8

0:4.18.0-240.rt7.54.el8

redhat/kernel<0:4.18.0-240.el8

0:4.18.0-240.el8

redhat/kernel-rt<0:4.18.0-193.80.1.rt13.130.el8_2

0:4.18.0-193.80.1.rt13.130.el8_2

redhat/kernel<0:4.18.0-193.80.1.el8_2

0:4.18.0-193.80.1.el8_2

debian/linux

4.19.249-24.19.289-25.10.197-15.10.191-16.1.66-16.1.69-16.5.13-16.6.9-1

Linux Linux kernel<=5.5.2

openSUSE Leap=15.1

Debian Debian Linux=8.0

Debian Debian Linux=9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/kernel-rt to a version that resolves this vulnerability.
Fixed in 0:3.10.0-1160.rt56.1131.el7
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:3.10.0-1160.el7
Upgrade
Upgrade redhat/kernel-rt to a version that resolves this vulnerability.
Fixed in 0:4.18.0-240.rt7.54.el8
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:4.18.0-240.el8
Upgrade
Upgrade redhat/kernel-rt to a version that resolves this vulnerability.
Fixed in 0:4.18.0-193.80.1.rt13.130.el8_2
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:4.18.0-193.80.1.el8_2
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 4.19.249-2Fixed in 4.19.289-2Fixed in 5.10.197-1Fixed in 5.10.191-1Fixed in 6.1.66-1Fixed in 6.1.69-1Fixed in 6.5.13-1Fixed in 6.6.9-1
Upgrade
Upgrade Linux kernel (vgacon_invert_region in drivers/video/console/vgacon.c) to a version that resolves this vulnerability.
Patch 513dc792d6060d5ef572e43852683097a8420f56
Operational
Apply the referenced kernel patch (513dc792d6060d5ef572e43852683097a8420f56) to remediate the use-after-free vulnerability in vgacon_invert_region in drivers/video/console/vgacon.c (present through 5.5.2).

Event History

Jan 30, 2020

CVE Published

12:00 AM

Feb 6, 2020

CVE Published

via MITRE·12:06 AM

Data Sourced

via MITRE·12:06 AM

Description

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Feb 13, 2020

Data Sourced

via Red Hat·11:56 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems that provide a local VGA console are exposed, particularly where an attacker can obtain local physical access to a virtual console. The listed affected software includes Linux kernel packages from Red Hat, Debian, and openSUSE Leap.

What does an attacker need to do to trigger the flaw?

The attacker needs local physical access to a VGA console and the ability to issue a terminal resize request. No user interaction is required, but the CVSS vector indicates low privileges are required.

What is the potential impact of successful exploitation?

The reported behavior can leak information to the local console through an out-of-bounds read. The CVSS vector also rates confidentiality and availability impact as high, while integrity impact is not indicated.

What kernel versions are identified as affected?

The vulnerability is described as present in the Linux kernel through version 5.5.2. No fixed version is provided in the supplied data.

CVE-2020-8649: Use After Free

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to trigger the flaw?

What is the potential impact of successful exploitation?

What kernel versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to trigger the flaw?

What is the potential impact of successful exploitation?

What kernel versions are identified as affected?