CVE-2020-25656
MEDIUM 4.1EPSS 0.4%
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
- Affected
- kernel
- CVSS v3.1 NVD
- 4.1 MEDIUM
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 1.9 LOW
AV:L/AC:M/Au:N/C:P/I:N/A:N - EPSS
- 0.44% chance of exploitation in the next 30 days, 37th percentile
- Published
- 2020-12-02
- Updated
- 2024-08-04
Proof-of-concept exploits (1)
Security advisories
- https://bugzilla.redhat.com/show_bug.cgi?id=1888726
- https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
- https://lkml.org/lkml/2020/10/29/528
- https://www.starwindsoftware.com/security/sw-20210325-0006