CVE-2020-28097: The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.

PriorityP424medium5.9CVSS 3.1

AVPACLPRLUINSUCHINAH

EPSS

0.52%

41.2th percentile

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.8.10-1 (bookworm)	linux 5.8.10-1 (bookworm)
linux	linux_kernel	< 5.8.10	5.8.10
linux	linux_kernel	>= 0 < 5.8.10-1	5.8.10-1
linux	linux_kernel	>= 0 < 5.8.10-1	5.8.10-1
linux	linux_kernel	>= 0 < 5.8.10-1	5.8.10-1
linux	linux_kernel	>= 0 < 5.8.10-1	5.8.10-1

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

nvdv2.03.6LOWAV:L/AC:L/Au:N/C:P/I:N/A:P

osv5.9MEDIUM

vendor_debian5.9MEDIUM

vendor_redhat5.9MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.