Use-after-free in Linux kernel - CVE-2020-25656

 

Use-after-free in Linux kernel - CVE-2020-25656

Published: March 18, 2021


Vulnerability identifier: #VU51547
CSH Severity: Low
CVSS v4 BT: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-25656
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error in the way the console subsystem uses KDGKBSENT and KDSKBSENT IOCTLs. A local user can run a specially crafted program to trigger an out-of-bounds read and gain access to sensitive information.



Affected software

Linux kernel
Amazon Linux AMI
Anolis OS
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Ubuntu
openEuler
Fedora
kernel (Red Hat package)
kernel-rt (Red Hat package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-generic-lpae-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-powerpc-e500mc-lts-xenial (Ubuntu package)
linux-image-powerpc-smp-lts-xenial (Ubuntu package)
linux-image-powerpc64-emb-lts-xenial (Ubuntu package)
linux-image-powerpc64-smp-lts-xenial (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-powerpc64-smp (Ubuntu package)
linux-image-powerpc64-emb (Ubuntu package)
linux-image-powerpc-smp (Ubuntu package)
linux-image-powerpc-e500mc (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.4.0-198-generic (Ubuntu package)
linux-image-4.4.0-198-generic-lpae (Ubuntu package)
linux-image-4.4.0-198-lowlatency (Ubuntu package)
linux-image-4.4.0-198-powerpc-e500mc (Ubuntu package)
linux-image-4.4.0-198-powerpc64-smp (Ubuntu package)
linux-image-4.4.0-198-powerpc64-emb (Ubuntu package)
linux-image-4.4.0-198-powerpc-smp (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1083-aws (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-1085-kvm (Ubuntu package)
linux-image-4.4.0-1119-aws (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.4.0-1143-raspi2 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.4.0-1147-snapdragon (Ubuntu package)
kernel
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-4.15.0-129-generic-lpae (Ubuntu package)
linux-image-4.15.0-129-lowlatency (Ubuntu package)
linux-image-4.15.0-129-generic (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1062-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-4.15.0-1077-raspi2 (Ubuntu package)
linux-image-4.15.0-1077-gke (Ubuntu package)
linux-image-4.15.0-1082-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1091-aws (Ubuntu package)
linux-image-4.15.0-1091-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1094-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-4.15.0-1103-azure (Ubuntu package)
perf
kernel-doc
kernel-tools-libs-devel
bpftool
kernel-core
kernel-cross-headers
kernel-debug
kernel-debug-core
kernel-debug-devel
kernel-debug-modules
kernel-devel
python3-perf
kernel-debug-modules-extra
kernel-abi-stablelists
kernel-tools-libs
kernel-tools
kernel-modules-extra
kernel-modules
kernel-headers
perf-debuginfo
python2-perf
python2-perf-debuginfo
python3-perf-debuginfo
kernel-tools-devel
kernel-tools-debuginfo
kernel-source
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
python-perf
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-59-generic (Ubuntu package)
linux-image-5.4.0-59-generic-lpae (Ubuntu package)
linux-image-5.4.0-59-lowlatency (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1026-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1031-kvm (Ubuntu package)
linux-image-5.4.0-1033-gcp (Ubuntu package)
linux-image-5.4.0-1033-gke (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-5.4.0-1034-aws (Ubuntu package)
linux-image-5.4.0-1034-oracle (Ubuntu package)
linux-image-5.4.0-1035-azure (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.8.0-44-generic-64k (Ubuntu package)
linux-image-5.8.0-44-generic-lpae (Ubuntu package)
linux-image-5.8.0-44-generic (Ubuntu package)
linux-image-5.8.0-44-lowlatency (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-5.8.0-1016-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1016-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1019-kvm (Ubuntu package)
linux-image-5.8.0-1021-oracle (Ubuntu package)
linux-image-5.8.0-1023-gcp (Ubuntu package)
linux-image-5.8.0-1023-azure (Ubuntu package)
linux-image-5.8.0-1024-aws (Ubuntu package)
Juniper Secure Analytics (JSA)
Technical Support Appliance
Data Computing Appliance (DCA)
IBM Cloud Pak for Watson AIOps
Session Smart Router
IBM Qradar SIEM
Juniper Junos Space

How to mitigate CVE-2020-25656

Install updates from vendor's website.

Linux kernel - update to 5.10
kernel (Red Hat package) - addressed in versions 3.10.0-1160.21.1.el7, 4.18.0-553.el8_10
kernel-rt (Red Hat package) - addressed in versions 3.10.0-1160.21.1.rt56.1158.el7, 4.18.0-553.rt7.342.el8_10
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
Technical Support Appliance - update to 3.0.1
Data Computing Appliance (DCA) - update to 4.3.0.0
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0.198.173
linux-image-generic-lpae-lts-xenial (Ubuntu package) - update to 4.4.0.198.173
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0.198.173
linux-image-powerpc-e500mc-lts-xenial (Ubuntu package) - update to 4.4.0.198.173
linux-image-powerpc-smp-lts-xenial (Ubuntu package) - update to 4.4.0.198.173
linux-image-powerpc64-emb-lts-xenial (Ubuntu package) - update to 4.4.0.198.173
linux-image-powerpc64-smp-lts-xenial (Ubuntu package) - update to 4.4.0.198.173
linux-image-virtual-lts-xenial (Ubuntu package) - update to 4.4.0.198.173
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.4.0.198.204, 4.15.0.129.116, 5.4.0.59.62, 5.8.0.44.49
linux-image-virtual (Ubuntu package) - addressed in versions 4.4.0.198.204, 4.15.0.129.116, 5.4.0.59.62, 5.8.0.44.49
linux-image-powerpc64-smp (Ubuntu package) - update to 4.4.0.198.204
linux-image-powerpc64-emb (Ubuntu package) - update to 4.4.0.198.204
linux-image-powerpc-smp (Ubuntu package) - update to 4.4.0.198.204
linux-image-powerpc-e500mc (Ubuntu package) - update to 4.4.0.198.204
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.4.0.198.204, 4.15.0.129.116, 5.4.0.59.62, 5.8.0.44.49
linux-image-generic (Ubuntu package) - addressed in versions 4.4.0.198.204, 4.15.0.129.116, 5.4.0.59.62, 5.8.0.44.49
linux-image-4.4.0-198-generic (Ubuntu package) - update to 4.4.0-198.230~14.04.1
linux-image-4.4.0-198-generic-lpae (Ubuntu package) - update to 4.4.0-198.230~14.04.1
linux-image-4.4.0-198-lowlatency (Ubuntu package) - update to 4.4.0-198.230~14.04.1
linux-image-4.4.0-198-powerpc-e500mc (Ubuntu package) - update to 4.4.0-198.230~14.04.1
linux-image-4.4.0-198-powerpc64-smp (Ubuntu package) - update to 4.4.0-198.230~14.04.1
linux-image-4.4.0-198-powerpc64-emb (Ubuntu package) - update to 4.4.0-198.230~14.04.1
linux-image-4.4.0-198-powerpc-smp (Ubuntu package) - update to 4.4.0-198.230~14.04.1
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0.1083.80, 4.4.0.1119.124, 5.4.0.1034.19, 5.4.0.1034.35, 5.8.0.1024.26
linux-image-4.4.0-1083-aws (Ubuntu package) - update to 4.4.0-1083.87
linux-image-kvm (Ubuntu package) - addressed in versions 4.4.0.1085.83, 4.15.0.1082.78, 5.4.0.1031.29, 5.8.0.1019.21
linux-image-4.4.0-1085-kvm (Ubuntu package) - update to 4.4.0-1085.94
linux-image-4.4.0-1119-aws (Ubuntu package) - update to 4.4.0-1119.133
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.4.0.1143.143, 4.15.0.1077.74, 5.4.0.1026.61
linux-image-4.4.0-1143-raspi2 (Ubuntu package) - update to 4.4.0-1143.153
linux-image-snapdragon (Ubuntu package) - addressed in versions 4.4.0.1147.139, 4.15.0.1094.97
linux-image-4.4.0-1147-snapdragon (Ubuntu package) - update to 4.4.0-1147.157
IBM Cloud Pak for Watson AIOps - update to 4.6.0
kernel - update to 4.14.209-117.337
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.129.128
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.129.128, 5.4.0.59.62, 5.4.0.59.65~18.04.54
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.129.128
linux-image-generic-lpae-hwe-16.04 (Ubuntu package) - update to 4.15.0.129.128
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.129.128
linux-image-4.15.0-129-generic-lpae (Ubuntu package) - update to 4.15.0-129.132~16.04.1
linux-image-4.15.0-129-lowlatency (Ubuntu package) - update to 4.15.0-129.132~16.04.1
linux-image-4.15.0-129-generic (Ubuntu package) - update to 4.15.0-129.132~16.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1062.51, 5.4.0.1034.31, 5.4.0.1034.36~18.04.18, 5.8.0.1021.20
linux-image-4.15.0-1062-oracle (Ubuntu package) - update to 4.15.0-1062.68~16.04.1
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1062.72
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1077.81, 4.15.0.1091.92, 5.8.0.1023.23
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1077.81
linux-image-4.15.0-1077-raspi2 (Ubuntu package) - update to 4.15.0-1077.82
linux-image-4.15.0-1077-gke (Ubuntu package) - update to 4.15.0-1077.82
linux-image-4.15.0-1082-kvm (Ubuntu package) - update to 4.15.0-1082.84
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1091.85
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1091.92, 5.4.0.1033.21, 5.4.0.1033.42, 5.8.0.1023.23
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1091.93
linux-image-4.15.0-1091-aws (Ubuntu package) - update to 4.15.0-1091.96~16.04.1
linux-image-4.15.0-1091-gcp (Ubuntu package) - update to 4.15.0-1091.104~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1091.109
linux-image-4.15.0-1094-snapdragon (Ubuntu package) - update to 4.15.0-1094.103
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1103.76
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1103.78, 4.15.0.1103.96, 5.4.0.1035.17, 5.4.0.1035.33, 5.8.0.1023.23
linux-image-4.15.0-1103-azure (Ubuntu package) - addressed in versions 4.15.0-1103.114~14.04.1, 4.15.0-1103.114~16.04.1
perf - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
kernel-doc - update to 4.18.0-553.5.1.0.1
kernel-tools-libs-devel - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
bpftool - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
kernel - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
kernel-core - update to 4.18.0-553.5.1.0.1
kernel-cross-headers - update to 4.18.0-553.5.1.0.1
kernel-debug - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
kernel-debug-core - update to 4.18.0-553.5.1.0.1
kernel-debug-devel - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
kernel-debug-modules - update to 4.18.0-553.5.1.0.1
kernel-devel - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
python3-perf - update to 4.18.0-553.5.1.0.1
kernel-debug-modules-extra - update to 4.18.0-553.5.1.0.1
kernel-abi-stablelists - update to 4.18.0-553.5.1.0.1
kernel-tools-libs - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
kernel-tools - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
kernel-modules-extra - update to 4.18.0-553.5.1.0.1
kernel-modules - update to 4.18.0-553.5.1.0.1
kernel-headers - addressed in versions 4.18.0-553.5.1.0.1, 4.19.91-26
perf-debuginfo - update to 4.19.90-2101.1.0.0055
python2-perf - update to 4.19.90-2101.1.0.0055
python2-perf-debuginfo - update to 4.19.90-2101.1.0.0055
perf - update to 4.19.90-2101.1.0.0055
python3-perf - update to 4.19.90-2101.1.0.0055
python3-perf-debuginfo - update to 4.19.90-2101.1.0.0055
kernel-tools-devel - update to 4.19.90-2101.1.0.0055
kernel-tools-debuginfo - update to 4.19.90-2101.1.0.0055
kernel-tools - update to 4.19.90-2101.1.0.0055
kernel-source - update to 4.19.90-2101.1.0.0055
kernel-devel - update to 4.19.90-2101.1.0.0055
kernel-debugsource - update to 4.19.90-2101.1.0.0055
kernel-debuginfo - update to 4.19.90-2101.1.0.0055
bpftool-debuginfo - update to 4.19.90-2101.1.0.0055
bpftool - update to 4.19.90-2101.1.0.0055
kernel - update to 4.19.90-2101.1.0.0055
python-perf - update to 4.19.91-26
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.59.62, 5.4.0.59.65~18.04.54
linux-image-5.4.0-59-generic (Ubuntu package) - addressed in versions 5.4.0-59.65, 5.4.0-59.65~18.04.1
linux-image-5.4.0-59-generic-lpae (Ubuntu package) - addressed in versions 5.4.0-59.65, 5.4.0-59.65~18.04.1
linux-image-5.4.0-59-lowlatency (Ubuntu package) - addressed in versions 5.4.0-59.65, 5.4.0-59.65~18.04.1
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-5.4.0-1026-raspi (Ubuntu package) - addressed in versions 5.4.0-1026.29, 5.4.0-1026.29~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1026.30
linux-image-raspi (Ubuntu package) - addressed in versions 5.4.0.1026.61, 5.8.0.1016.19
linux-image-5.4.0-1031-kvm (Ubuntu package) - update to 5.4.0-1031.32
linux-image-5.4.0-1033-gcp (Ubuntu package) - addressed in versions 5.4.0-1033.35, 5.4.0-1033.35~18.04.1
linux-image-5.4.0-1033-gke (Ubuntu package) - update to 5.4.0-1033.35~18.04.1
linux-image-gke-5.4 (Ubuntu package) - update to 5.4.0.1033.35~18.04.2
linux-image-5.4.0-1034-aws (Ubuntu package) - addressed in versions 5.4.0-1034.35, 5.4.0-1034.35~18.04.1
linux-image-5.4.0-1034-oracle (Ubuntu package) - addressed in versions 5.4.0-1034.36, 5.4.0-1034.36~18.04.1
linux-image-5.4.0-1035-azure (Ubuntu package) - addressed in versions 5.4.0-1035.36, 5.4.0-1035.36~18.04.1
Session Smart Router - addressed in versions 5.4.7, 5.5.3
linux-image-generic-64k (Ubuntu package) - update to 5.8.0.44.49
linux-image-oem-20.04 (Ubuntu package) - update to 5.8.0.44.49
linux-image-5.8.0-44-generic-64k (Ubuntu package) - update to 5.8.0-44.50
linux-image-5.8.0-44-generic-lpae (Ubuntu package) - update to 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-generic (Ubuntu package) - update to 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-lowlatency (Ubuntu package) - update to 5.8.0-44.50~20.04.1
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-5.8.0-1016-raspi-nolpae (Ubuntu package) - update to 5.8.0-1016.19
linux-image-5.8.0-1016-raspi (Ubuntu package) - update to 5.8.0-1016.19
linux-image-raspi-nolpae (Ubuntu package) - update to 5.8.0.1016.19
linux-image-5.8.0-1019-kvm (Ubuntu package) - update to 5.8.0-1019.21
linux-image-5.8.0-1021-oracle (Ubuntu package) - update to 5.8.0-1021.22
linux-image-5.8.0-1023-gcp (Ubuntu package) - update to 5.8.0-1023.24
linux-image-5.8.0-1023-azure (Ubuntu package) - update to 5.8.0-1023.25
linux-image-5.8.0-1024-aws (Ubuntu package) - update to 5.8.0-1024.26
kernel-headers - addressed in versions 5.9.7-100.fc32, 5.9.7-200.fc33
kernel-tools - addressed in versions 5.9.7-100.fc32, 5.9.7-200.fc33
kernel - addressed in versions 5.9.8-100.fc32, 5.9.8-200.fc33
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF03
Juniper Junos Space - update to 21.2R1

External References

Related Security Bulletins