CVE-2020-14331
published 2020-09-15CVE-2020-14331: A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an…
PriorityP430medium6.6CVSS 3.1
AVPACLPRLUINSUCHIHAH
EPSS
0.56%
43.1th percentile
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.7.17-1 (bookworm) | linux 5.7.17-1 (bookworm) |
| linux | linux_kernel | <= 5.7.19 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.7.17-1 | 5.7.17-1 |
| linux | linux_kernel | >= 0 < 5.7.17-1 | 5.7.17-1 |
| linux | linux_kernel | >= 0 < 5.7.17-1 | 5.7.17-1 |
| linux | linux_kernel | >= 0 < 5.7.17-1 | 5.7.17-1 |
| msrc | cm1_kernel_5.4.91-3_on_cbl_mariner_1.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.6MEDIUMCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv6.6MEDIUM
vendor_debian6.6LOW
vendor_msrc6.6MEDIUM
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x3f8-pg55-6qfg: A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, c
ghsa_unreviewed·2022-05-24
CVE-2020-14331 [HIGH] CWE-787 GHSA-x3f8-pg55-6qfg: A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, c
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
OSV
CVE-2020-14331: A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, c
osv·2020-09-15·CVSS 6.6
CVE-2020-14331 [MEDIUM] CVE-2020-14331: A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, c
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Kernel
vgacon: Fix for missing check in scrollback handling
kernel_security·2020-07-28·CVSS 6.6
CVE-2020-14331 [MEDIUM] vgacon: Fix for missing check in scrollback handling
vgacon: Fix for missing check in scrollback handling
vgacon_scrollback_update() always leaves enbough room in the scrollback
buffer for the next call, but if the console size changed that room
might not actually be enough, and so we need to re-check.
The check should be in the loop since vgacon_scrollback_cur->tail is
updated in the loop and count may be more than 1 when triggered by CSI M,
as Jiri's PoC:
#include
#include
#include
#include
#include
#include
#include
int main(int argc, char** argv)
{
int fd = open("/dev/tty1", O_RDWR);
unsigned short size[3] = {25, 200, 0};
ioctl(fd, 0x5609, size); // VT_RESIZE
write(fd, "\e[1;1H", 6);
for (int i = 0; i
Reported-by: Yang Yingliang
Reported-by: Kyungtae Kim
Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
Cc: stable
Microsoft
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console calling an ioctl VT_RESIZE which causes an out-of-bo
vendor_msrc·2020-09-08·CVSS 6.6
CVE-2020-14331 [MEDIUM] CWE-787 A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console calling an ioctl VT_RESIZE which causes an out-of-bo
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console calling an ioctl VT_RESIZE which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the ope
Red Hat
kernel: kernel: buffer over write in vgacon_scroll
vendor_redhat·2020-07-28·CVSS 6.6
CVE-2020-14331 [MEDIUM] CWE-787 kernel: kernel: buffer over write in vgacon_scroll
kernel: kernel: buffer over write in vgacon_scroll
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the
Debian
CVE-2020-14331: linux - A flaw was found in the Linux kernel’s implementation of the invert video code o...
vendor_debian·2020·CVSS 6.6
CVE-2020-14331 [MEDIUM] CVE-2020-14331: linux - A flaw was found in the Linux kernel’s implementation of the invert video code o...
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Scope: local
bookworm: resolved (fixed in 5.7.17-1)
bullseye: resolved (fixed in 5.7.17-1)
forky: resolved (fixed in 5.7.17-1)
sid: resolved (fixed in 5.7.17-1)
trixie: resolved (fixed in 5.7.17-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-14331 kernel: kernel: buffer over write in vgacon_scroll [fedora-all]
bugzilla·2020-07-28·CVSS 6.6
CVE-2020-14331 [MEDIUM] CVE-2020-14331 kernel: kernel: buffer over write in vgacon_scroll [fedora-all]
CVE-2020-14331 kernel: kernel: buffer over write in vgacon_scroll [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported version
Bugzilla
CVE-2020-14331 kernel: kernel: buffer over write in vgacon_scroll
bugzilla·2020-07-20·CVSS 6.6
CVE-2020-14331 [MEDIUM] CVE-2020-14331 kernel: kernel: buffer over write in vgacon_scroll
CVE-2020-14331 kernel: kernel: buffer over write in vgacon_scroll
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console both calling ioctl VT_RESIZE. An out-of-bounds write can occur. A local user with access to the VGA console could use this flaw to crash the system, potentially escalating their privileges on the system.
Discussion:
Mitigation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
---
Statement:
This flaw is rated as a having Moderate impact, because only local user with access to VGA console can
https://bugzilla.redhat.com/show_bug.cgi?id=1858679https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlhttps://lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlhttps://lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlhttps://lists.openwall.net/linux-kernel/2020/07/29/234https://www.openwall.com/lists/oss-security/2020/07/28/2https://bugzilla.redhat.com/show_bug.cgi?id=1858679https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlhttps://lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlhttps://lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlhttps://lists.openwall.net/linux-kernel/2020/07/29/234https://www.openwall.com/lists/oss-security/2020/07/28/2
2020-09-15
Published