CVE-2020-25669
published 2021-05-26CVE-2020-25669: A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.63%
46.6th percentile
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 5.9.11-1 (bookworm) | linux 5.9.11-1 (bookworm) |
| linux | linux_kernel | < 4.4.245 | 4.4.245 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.9.11-1 | 5.9.11-1 |
| linux | linux_kernel | >= 0 < 5.9.11-1 | 5.9.11-1 |
| linux | linux_kernel | >= 0 < 5.9.11-1 | 5.9.11-1 |
| linux | linux_kernel | >= 0 < 5.9.11-1 | 5.9.11-1 |
| linux | linux_kernel | >= 0 < 4.4.0-201.233 | 4.4.0-201.233 |
| linux | linux_kernel | >= 0 < 4.15.0-136.140 | 4.15.0-136.140 |
| linux | linux_kernel | >= 0 < 5.4.0-66.74 | 5.4.0-66.74 |
| linux | linux_kernel | >= 4.10 < 4.14.208 | 4.14.208 |
| linux | linux_kernel | >= 4.15 < 4.19.159 | 4.19.159 |
| linux | linux_kernel | >= 4.20 < 5.4.79 | 5.4.79 |
| linux | linux_kernel | >= 4.5 < 4.9.245 | 4.9.245 |
| linux | linux_kernel | >= 5.5 < 5.9.10 | 5.9.10 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pc2x-7x93-j3gg: A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed
ghsa_unreviewed·2022-05-24
CVE-2020-25669 [HIGH] CWE-416 GHSA-pc2x-7x93-j3gg: A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.
OSV
CVE-2020-25669: A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed
osv·2021-05-26·CVSS 7.8
CVE-2020-25669 [HIGH] CVE-2020-25669: A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.
OSV
linux-oem-5.6 vulnerabilities
osv·2021-04-13·CVSS 7.8
CVE-2021-29154 [HIGH] linux-oem-5.6 vulnerabilities
linux-oem-5.6 vulnerabilities
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
It was discovered that the HID multitouch implementation within the Linux
kernel did not properly validate input events in some situations. A
physically proximate attacker could use this to cause a denial
OSV
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities
osv·2021-02-25·CVSS 4.1
CVE-2020-25656 [MEDIUM] linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
Kiyin (尹亮) discovered that the perf subsystem in the Linu
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabil
osv·2021-02-25·CVSS 7.8
CVE-2020-25669 [HIGH] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabil
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in s
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-ra
osv·2021-02-25·CVSS 7.8
CVE-2020-25669 [HIGH] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-ra
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly hand
OSV
linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2021-02-02·CVSS 5.5
CVE-2020-28374 [MEDIUM] linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the LIO SCSI target implementation in the Linux
kernel performed insufficient identifier checking in certain XCOPY
requests. An attacker with access to at least one LUN in a multiple
backstore environment could use this to expose sensitive information or
modify data. (CVE-2020-28374)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
It was discovered that the btrfs file system implementation in the Linux
kernel did not properly validate file system metadata in some situations.
An atta
OSV
linux, linux-lts-xenial vulnerabilities
osv·2021-01-28·CVSS 5.5
CVE-2018-13093 [MEDIUM] linux, linux-lts-xenial vulnerabilities
linux, linux-lts-xenial vulnerabilities
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
It was discovered that the btrfs file system implementation in the Linux
kernel did not properly validate file system metadata in some situations.
An attacker could use this to construct a malicious btrfs image that, when
mounted, could cause a denial of service (system crash). (CVE-2019-19813,
CVE-2019-19816)
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly exe
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2021-04-13·CVSS 7.8
CVE-2020-14351 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
It was discovered that the HID multitouch implementation within the Linux
kernel did not properly validate input events in som
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-02-25·CVSS 7.8
CVE-2020-25669 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-2
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-02-25·CVSS 7.8
CVE-2020-27815 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-2
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-02-25·CVSS 4.1
CVE-2020-25704 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-02-02·CVSS 5.5
CVE-2020-28374 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the LIO SCSI target implementation in the Linux
kernel performed insufficient identifier checking in certain XCOPY
requests. An attacker with access to at least one LUN in a multiple
backstore environment could use this to expose sensitive information or
modify data. (CVE-2020-28374)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
It was discovered that the btrfs file system implementation in the Linux
kernel did not properly validate file system met
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-01-28·CVSS 5.5
CVE-2020-27777 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
It was discovered that the btrfs file system implementation in the Linux
kernel did not properly validate file system metadata in some situations.
An attacker could use this to construct a malicious btrfs image that, when
mounted, could cause a denial of service (system crash). (CVE-2019-19813,
CVE-2019-19816)
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attack
Red Hat
kernel: use-after-free read in sunkbd_reinit in drivers/input/keyboard/sunkbd.c
vendor_redhat·2020-11-05·CVSS 7.8
CVE-2020-25669 [HIGH] CWE-416 kernel: use-after-free read in sunkbd_reinit in drivers/input/keyboard/sunkbd.c
kernel: use-after-free read in sunkbd_reinit in drivers/input/keyboard/sunkbd.c
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2020-25669: linux - A vulnerability was found in the Linux Kernel where the function sunkbd_reinit h...
vendor_debian·2020·CVSS 7.8
CVE-2020-25669 [HIGH] CVE-2020-25669: linux - A vulnerability was found in the Linux Kernel where the function sunkbd_reinit h...
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.
Scope: local
bookworm: resolved (fixed in 5.9.11-1)
bullseye: resolved (fixed in 5.9.11-1)
forky: resolved (fixed in 5.9.11-1)
sid: resolved (fixed in 5.9.11-1)
trixie: resolved (fixed in 5.9.11-1)
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2020/11/05/2http://www.openwall.com/lists/oss-security/2020/11/20/5https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2020/12/msg00027.htmlhttps://security.netapp.com/advisory/ntap-20210702-0006/https://www.openwall.com/lists/oss-security/2020/11/05/2%2Chttps://www.openwall.com/lists/oss-security/2020/11/20/5%2Chttp://www.openwall.com/lists/oss-security/2020/11/05/2http://www.openwall.com/lists/oss-security/2020/11/20/5https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2020/12/msg00027.htmlhttps://security.netapp.com/advisory/ntap-20210702-0006/https://www.openwall.com/lists/oss-security/2020/11/05/2%2Chttps://www.openwall.com/lists/oss-security/2020/11/20/5%2C
2021-05-26
Published