Bug 2236834 (CVE-2020-27418) - CVE-2020-27418 kernel: User after free via vgacon_invert_region() function
Summary: CVE-2020-27418 kernel: User after free via vgacon_invert_region() function
Keywords:
Status: NEW
Alias: CVE-2020-27418
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2236835
TreeView+ depends on / blocked
 
Reported: 2023-09-01 17:22 UTC by Pedro Sampaio
Modified: 2023-10-16 22:36 UTC (History)
47 users (show)

Fixed In Version: Kernel 5.6-rc5
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free vulnerability was found in the vgacon_invert_region in drivers/video/console/vgacon.c in the low-level VGA-based console driver in the Linux kernel. This flaw allows a local privileged attacker to crash the system due to a missing sanity check, causing a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2023-09-01 17:22:33 UTC 
A Use After Free vulnerability was found in  vgacon_invert_region in drivers/video/console/vgacon.c in Low level VGA based console driver in Linux Kernel. In this flaw, a local privileged attacker may crash the system due to a missing sanity check and cause a denial of service problem.

References:

https://patchwork.freedesktop.org/patch/356372/
http://fedora.com
Comment 8 Steve Beattie 2023-10-16 22:36:34 UTC 
Hi, based on the referenced patch and description, this looks to have been fixed upstream in 513dc792d606 ("vgacon: Fix a UAF in vgacon_invert_region") <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=513dc792d606> (v5.6-rc5), which already was assigned CVE-2020-8647 and CVE-2020-8649; is this a duplicate CVE assignment?

Thanks for any clarity.
Note You need to log in before you can comment on or make changes to this bug.