Bug 2016169 (CVE-2020-13974) - CVE-2020-13974 kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c
Summary: CVE-2020-13974 kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboa...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-13974
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2016170 2017044 2017045 2017047
Blocks: 2016171
TreeView+ depends on / blocked
 
Reported: 2021-10-20 20:13 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-06-16 11:23 UTC (History)
44 users (show)

Fixed In Version: kernel 5.8-rc1
Doc Type: If docs needed, set a value
Doc Text:
A flaw integer overflow in the Linux kernel's virtual terminal keyboard driver was found in the way the user sends some specific keyboard code multiple times. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2022-05-11 11:45:27 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:2229 0 None None None 2022-05-12 11:26:46 UTC
Red Hat Product Errata RHBA-2022:4630 0 None None None 2022-05-18 11:46:32 UTC
Red Hat Product Errata RHBA-2022:4693 0 None None None 2022-05-19 05:10:58 UTC
Red Hat Product Errata RHBA-2022:4969 0 None None None 2022-06-08 18:40:05 UTC
Red Hat Product Errata RHBA-2022:5088 0 None None None 2022-06-16 11:23:18 UTC
Red Hat Product Errata RHSA-2022:1975 0 None None None 2022-05-10 14:40:03 UTC
Red Hat Product Errata RHSA-2022:1988 0 None None None 2022-05-10 14:45:55 UTC

Description Guilherme de Almeida Suckevicz 2021-10-20 20:13:17 UTC 
An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.

Reference:
https://lkml.org/lkml/2020/3/22/482

Upstream patches:
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=dad0bf9ce93fa40b667eccd3306783f4db4b932b
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b86dab054059b970111b5516ae548efaae5b3aae
Comment 1 Guilherme de Almeida Suckevicz 2021-10-20 20:13:56 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2016170]
Comment 6 Justin M. Forbes 2021-10-25 18:39:39 UTC 
This was fixed for Fedora with the 5.6.18 stable kernel updates.
Comment 9 errata-xmlrpc 2022-05-10 14:40:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1975 https://access.redhat.com/errata/RHSA-2022:1975
Comment 10 errata-xmlrpc 2022-05-10 14:45:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1988 https://access.redhat.com/errata/RHSA-2022:1988
Comment 11 Product Security DevOps Team 2022-05-11 11:45:24 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-13974
Note You need to log in before you can comment on or make changes to this bug.