CVE-2020-8649: Use After Free
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console. An out-of-bounds read can occur, leaking information to the console.
Other sources
A flaw was found in the Linux kernels implementation of VGA local console in the vgaconinvertregion functionality. An attacker with local physical access to a "VGA console" (think local virtual console) who is able to issue a terminal resize request could possibly cause a leak of information to the local console.
Reference: https://bugzilla.kernel.org/showbug.cgi?id=206357 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=513dc792d6060d5ef572e43852683097a8420f56
— Red Hat
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgaconinvertregion function in drivers/video/console/vgacon.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.80.1.rt13.130.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.80.1.el8_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 4.19.249-2Fixed in 4.19.289-2Fixed in 5.10.197-1Fixed in 5.10.191-1Fixed in 6.1.66-1Fixed in 6.1.69-1Fixed in 6.5.13-1Fixed in 6.6.9-1 - Upgrade
Upgrade
Linux kernel (vgacon_invert_region in drivers/video/console/vgacon.c)to a version that resolves this vulnerability.Patch 513dc792d6060d5ef572e43852683097a8420f56 - Operational
Apply the referenced kernel patch (513dc792d6060d5ef572e43852683097a8420f56) to remediate the use-after-free vulnerability in vgacon_invert_region in drivers/video/console/vgacon.c (present through 5.5.2).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that provide a local VGA console are exposed, particularly where an attacker can obtain local physical access to a virtual console. The listed affected software includes Linux kernel packages from Red Hat, Debian, and openSUSE Leap.
What does an attacker need to do to trigger the flaw?
The attacker needs local physical access to a VGA console and the ability to issue a terminal resize request. No user interaction is required, but the CVSS vector indicates low privileges are required.
What is the potential impact of successful exploitation?
The reported behavior can leak information to the local console through an out-of-bounds read. The CVSS vector also rates confidentiality and availability impact as high, while integrity impact is not indicated.
What kernel versions are identified as affected?
The vulnerability is described as present in the Linux kernel through version 5.5.2. No fixed version is provided in the supplied data.