CVE-2020-25656
published 2020-12-02CVE-2020-25656: A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could…
PriorityP419medium4.1CVSS 3.1
AVLACHPRHUINSUCHINAN
EPSS
0.43%
35.2th percentile
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 5.9.6-1 (bookworm) | linux 5.9.6-1 (bookworm) |
| linux | linux_kernel | < 5.10 | 5.10 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.9.6-1 | 5.9.6-1 |
| linux | linux_kernel | >= 0 < 5.9.6-1 | 5.9.6-1 |
| linux | linux_kernel | >= 0 < 5.9.6-1 | 5.9.6-1 |
| linux | linux_kernel | >= 0 < 5.9.6-1 | 5.9.6-1 |
| linux | linux_kernel | >= 0 < 4.4.0-198.230 | 4.4.0-198.230 |
| linux | linux_kernel | >= 0 < 4.15.0-129.132 | 4.15.0-129.132 |
| linux | linux_kernel | >= 0 < 5.4.0-59.65 | 5.4.0-59.65 |
| msrc | cm1_kernel_5.4.91-1_on_cbl_mariner_1.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| starwindsoftware | starwind_virtual_san | — | — |
CVSS provenance
nvdv3.14.1MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
osv8.2HIGH
vendor_ubuntu8.2HIGH
vendor_debian4.1MEDIUM
vendor_msrc4.1MEDIUM
vendor_redhat4.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4pfp-w4vm-364q: A flaw was found in the Linux kernel
ghsa_unreviewed·2022-05-24
CVE-2020-25656 [MEDIUM] CWE-416 GHSA-4pfp-w4vm-364q: A flaw was found in the Linux kernel
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
OSV
CVE-2020-25656: In vt_do_kdgkb_ioctl of keyboard
osv·2021-05-01
CVE-2020-25656 CVE-2020-25656: In vt_do_kdgkb_ioctl of keyboard
In vt_do_kdgkb_ioctl of keyboard.c, there is a possible use after free read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
OSV
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities
osv·2021-02-25·CVSS 4.1
CVE-2020-25656 [MEDIUM] linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
Kiyin (尹亮) discovered that the perf subsystem in the Linu
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2021-01-06·CVSS 8.2
CVE-2019-19770 [HIGH] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that debugfs in the Linux kernel as used by blktrace
contained a use-after-free in some situations. A privileged local attacker
could possibly use this to cause a denial of service (system crash).
(CVE-2019-19770)
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secur
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabi
osv·2021-01-06·CVSS 4.1
CVE-2020-25656 [MEDIUM] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabi
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did
not properly deallocate memory in some situations. A privileged attacker
could use this to cause a denial of
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
osv·2021-01-06·CVSS 5.5
CVE-2019-0148 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
Ryan Hall discovered that the Intel 700 Series Ethernet Controllers driver
in the Linux kernel did not properly deallocate memory in some conditions.
A local attacker could use this to cause a denial of service (kernel memory
exhaustion). (CVE-2019-0148)
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Jinoh Kang discovered that the Xen
OSV
CVE-2020-25656: A flaw was found in the Linux kernel
osv·2020-12-02·CVSS 4.1
CVE-2020-25656 [MEDIUM] CVE-2020-25656: A flaw was found in the Linux kernel
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
Kernel
vt: keyboard, extend func_buf_lock to readers
kernel_security·2020-10-19·CVSS 4.1
CVE-2020-25656 [MEDIUM] vt: keyboard, extend func_buf_lock to readers
vt: keyboard, extend func_buf_lock to readers
Both read-side users of func_table/func_buf need locking. Without that,
one can easily confuse the code by repeatedly setting altering strings
like:
while (1)
for (a = 0; a kb_string' for that purpose.
Note that the program above needs at least CAP_SYS_TTY_CONFIG.
This depends on the previous patch and on the func_buf_lock lock added
in commit 46ca3f735f34 (tty/vt: fix write/write race in ioctl(KDSKBSENT)
handler) in 5.2.
Likely fixes CVE-2020-25656.
Cc:
Reported-by: Minh Yuan
Signed-off-by: Jiri Slaby
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-02-25·CVSS 4.1
CVE-2020-25704 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-01-06·CVSS 5.5
CVE-2020-25668 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ryan Hall discovered that the Intel 700 Series Ethernet Controllers driver
in the Linux kernel did not properly deallocate memory in some conditions.
A local attacker could use this to cause a denial of service (kernel memory
exhaustion). (CVE-2019-0148)
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Jinoh Kang discovered that
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-01-06·CVSS 8.2
CVE-2020-0423 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that debugfs in the Linux kernel as used by blktrace
contained a use-after-free in some situations. A privileged local attacker
could possibly use this to cause a denial of service (system crash).
(CVE-2019-19770)
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secure-connections pairing authentication in the
Bluetooth protocol could allow an unauthenti
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-01-06·CVSS 4.1
CVE-2020-28974 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did
not properly deallocate memory in some situations. A privileged attacker
could use this to cause a denial of service (kernel memory exhaustion).
(CVE-2020-25704)
Jinoh Kang discovered that the Xen event channel i
Microsoft
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access o
vendor_msrc·2020-12-08·CVSS 4.1
CVE-2020-25656 [MEDIUM] CWE-416 A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access o
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for
Red Hat
kernel: use-after-free in read in vt_do_kdgkb_ioctl
vendor_redhat·2020-10-16·CVSS 4.1
CVE-2020-25656 [MEDIUM] CWE-416 kernel: use-after-free in read in vt_do_kdgkb_ioctl
kernel: use-after-free in read in vt_do_kdgkb_ioctl
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
Statement: This issue is rated as having Moderate impact because of the attack scenario limitation where only local user with access to VT console if at least CAP_SYS_TTY_CONF
Debian
CVE-2020-25656: linux - A flaw was found in the Linux kernel. A use-after-free was found in the way the ...
vendor_debian·2020·CVSS 4.1
CVE-2020-25656 [MEDIUM] CVE-2020-25656: linux - A flaw was found in the Linux kernel. A use-after-free was found in the way the ...
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
Scope: local
bookworm: resolved (fixed in 5.9.6-1)
bullseye: resolved (fixed in 5.9.6-1)
forky: resolved (fixed in 5.9.6-1)
sid: resolved (fixed in 5.9.6-1)
trixie: resolved (fixed in 5.9.6-1)
No detection rules found.
No public exploits indexed.
arXiv
KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities
arxiv_fulltext·2024-09-24
KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities
: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities
Bonan Ruan
National University of Singapore
Jiahao Liu
National University of Singapore
Chuqi Zhang
National University of Singapore
Zhenkai Liang
National University of Singapore
## Abstract
Linux kernel vulnerability reproduction is a critical task in system security.
To reproduce a kernel vulnerability, the vulnerable environment and the Proof of Concept (PoC) program are needed.
Most existing research focuses on the generation of PoC, while the construction of environment is overlooked.
However, establishing an effective vulnerable environment to trigger a vulnerability is challenging.
Firstly, it is hard to guarantee that the selected kernel version for reproduction is vulnerable, as the vulner
Bugzilla
CVE-2020-25656 kernel: use-after-free in read in vt_do_kdgkb_ioctl
bugzilla·2020-10-15·CVSS 4.1
CVE-2020-25656 [MEDIUM] CVE-2020-25656 kernel: use-after-free in read in vt_do_kdgkb_ioctl
CVE-2020-25656 kernel: use-after-free in read in vt_do_kdgkb_ioctl
A flaw was found in Linux Kernel, where a race in KDGKBSENT and KDSKBSENT leads to use-after-free read in vt_do_kdgkb_ioctl
References:
https://groups.google.com/g/syzkaller-bugs/c/kZsmxkpq3UI/m/J35PFexWBgAJ?pli=1
Discussion:
References:
https://www.openwall.com/lists/oss-security/2020/10/16/1
---
List of patches:
1. Older patches (already applied for 5.9 Kernel):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/tty/vt/keyboard.c?id=6ca03f90527e499dd5e32d6522909e2ad390896b
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/tty/vt/keyboard.c?id=82e61c3909db51d91b9d3e2071557b6435018b80
2. Suggested patch for resolving issue:
https://lkml.org/lkml/2020/10/29
https://bugzilla.redhat.com/show_bug.cgi?id=1888726https://lists.debian.org/debian-lts-announce/2020/12/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2020/12/msg00027.htmlhttps://lkml.org/lkml/2020/10/16/84https://lkml.org/lkml/2020/10/29/528https://www.starwindsoftware.com/security/sw-20210325-0006/https://bugzilla.redhat.com/show_bug.cgi?id=1888726https://lists.debian.org/debian-lts-announce/2020/12/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2020/12/msg00027.htmlhttps://lkml.org/lkml/2020/10/16/84https://lkml.org/lkml/2020/10/29/528https://www.starwindsoftware.com/security/sw-20210325-0006/
2020-12-02
Published