Buffer Over-read in Linux kernel - CVE-2020-28915

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU64793

Buffer Over-read in Linux kernel - CVE-2020-28915

Published: June 29, 2022 / Updated: July 20, 2022


Vulnerability identifier: #VU64793
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-28915
CWE-ID: CWE-126
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user with physical access to perform a denial of service attack.

The vulnerability exists due to an out-of-bounds (OOB) memory access flaw in fbcon_get_font() function in drivers/video/fbdev/core/fbcon.c in fbcon driver module in the Linux kernel. A local user with special user privilege and with physical access can gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information.


Affected software

Linux kernel
Red Hat Enterprise Linux for Real Time for NFV
Anolis OS
Oracle Linux
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Ubuntu
openEuler
Migration Toolkit for Containers
IBM Spectrum Copy Data Management
Red Hat Advanced Cluster Management for Kubernetes
OpenShift Logging
IBM Spectrum Protect Plus
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
linux (Ubuntu package)
linux-raspi2 (Ubuntu package)
linux-lts-xenial (Ubuntu package)
linux-kvm (Ubuntu package)
linux-aws (Ubuntu package)
linux-snapdragon (Ubuntu package)
linux-hwe (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux-oracle (Ubuntu package)
linux-oem (Ubuntu package)
linux-gke-4.15 (Ubuntu package)
linux-aws-hwe (Ubuntu package)
linux-azure-4.15 (Ubuntu package)
linux-gcp-4.15 (Ubuntu package)
linux-hwe-5.4 (Ubuntu package)
linux-raspi (Ubuntu package)
linux-aws-5.4 (Ubuntu package)
linux-azure-5.4 (Ubuntu package)
linux-gcp-5.4 (Ubuntu package)
linux-oracle-5.4 (Ubuntu package)
linux-raspi-5.4 (Ubuntu package)
linux-oem-5.6 (Ubuntu package)
kernel-debug-devel
kernel-abi-stablelists
python3-perf
perf
kernel-tools-libs
kernel-tools
kernel-modules-extra
kernel-modules
kernel-headers
kernel-devel
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-core
kernel-debug
kernel-cross-headers
kernel-core
kernel
bpftool
kernel-doc
python3-perf-debuginfo
bpftool-debuginfo
python2-perf
kernel-tools-devel
kernel-tools-debuginfo
python2-perf-debuginfo
kernel-source
perf-debuginfo
kernel-debuginfo
kernel-debugsource
linux-image-4.15.0-128-lowlatency (Ubuntu package)
linux-image-4.15.0-128-generic-lpae (Ubuntu package)
linux-image-4.15.0-128-generic (Ubuntu package)
linux-image-4.15.0-1061-oracle (Ubuntu package)
linux-image-4.15.0-1076-gke (Ubuntu package)
linux-image-4.15.0-1081-kvm (Ubuntu package)
linux-image-4.15.0-1090-aws (Ubuntu package)
linux-image-4.15.0-1090-gcp (Ubuntu package)
linux-image-4.15.0-1093-snapdragon (Ubuntu package)
linux-image-4.15.0-1102-azure (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-5.4.0-58-lowlatency (Ubuntu package)
linux-image-5.4.0-58-generic-lpae (Ubuntu package)
linux-image-5.4.0-58-generic (Ubuntu package)
linux-image-5.4.0-1025-raspi (Ubuntu package)
linux-image-5.4.0-1030-kvm (Ubuntu package)
linux-image-5.4.0-1032-aws (Ubuntu package)
linux-image-5.4.0-1032-gcp (Ubuntu package)
linux-image-5.4.0-1032-oracle (Ubuntu package)
linux-image-5.4.0-1033-oracle (Ubuntu package)
linux-image-5.4.0-1034-azure (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.8.0-31-lowlatency (Ubuntu package)
linux-image-5.8.0-31-generic-lpae (Ubuntu package)
linux-image-5.8.0-31-generic-64k (Ubuntu package)
linux-image-5.8.0-31-generic (Ubuntu package)
linux-image-5.8.0-33-generic-lpae (Ubuntu package)
linux-image-5.8.0-33-generic (Ubuntu package)
linux-image-5.8.0-33-generic-64k (Ubuntu package)
linux-image-5.8.0-33-lowlatency (Ubuntu package)
linux-image-5.8.0-1008-raspi (Ubuntu package)
linux-image-5.8.0-1008-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1010-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1010-raspi (Ubuntu package)
linux-image-5.8.0-1011-oracle (Ubuntu package)
linux-image-5.8.0-1011-kvm (Ubuntu package)
linux-image-5.8.0-1012-gcp (Ubuntu package)
linux-image-5.8.0-1013-oracle (Ubuntu package)
linux-image-5.8.0-1013-kvm (Ubuntu package)
linux-image-5.8.0-1013-azure (Ubuntu package)
linux-image-5.8.0-1014-gcp (Ubuntu package)
linux-image-5.8.0-1014-aws (Ubuntu package)
linux-image-5.8.0-1015-azure (Ubuntu package)
linux-image-5.8.0-1016-aws (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)

How to mitigate CVE-2020-28915

Install updates from vendor's website.

Linux kernel - update to 5.8.15
Migration Toolkit for Containers - update to 1.7.3
IBM Spectrum Copy Data Management - update to 2.2.17
Red Hat Advanced Cluster Management for Kubernetes - update to 2.5.1
OpenShift Logging - update to 5.4.3
IBM Spectrum Protect Plus - update to 10.1.13
linux (Ubuntu package) - addressed in versions 4.4.0-197.229, 4.15.0-126.129, 5.4.0-56.62
linux-raspi2 (Ubuntu package) - addressed in versions 4.4.0-1142.152, 4.15.0-1074.79
linux-lts-xenial (Ubuntu package) - update to 4.4.0-197.229~14.04.1
linux-kvm (Ubuntu package) - addressed in versions 4.4.0-1084.93, 4.15.0-1079.81, 5.4.0-1028.29
linux-aws (Ubuntu package) - addressed in versions 4.4.0-1082.86, 4.4.0-1118.132, 4.15.0-1088.93, 5.4.0-1030.31
linux-snapdragon (Ubuntu package) - addressed in versions 4.4.0-1146.156, 4.15.0-1091.100
linux-hwe (Ubuntu package) - update to 4.15.0-126.129~16.04.1
linux-gcp (Ubuntu package) - addressed in versions 4.15.0-1088.101~16.04.1, 5.4.0-1030.32
linux-azure (Ubuntu package) - addressed in versions 4.15.0-1100.111~14.04.1, 4.15.0-1100.111~16.04.1, 5.4.0-1032.33
linux-oracle (Ubuntu package) - addressed in versions 4.15.0-1059.65~16.04.1, 4.15.0-1059.65, 5.4.0-1030.32
linux-oem (Ubuntu package) - update to 4.15.0-1103.114
linux-gke-4.15 (Ubuntu package) - update to 4.15.0-1074.79
linux-aws-hwe (Ubuntu package) - update to 4.15.0-1088.93~16.04.1
linux-azure-4.15 (Ubuntu package) - update to 4.15.0-1100.111
linux-gcp-4.15 (Ubuntu package) - update to 4.15.0-1088.101
linux-hwe-5.4 (Ubuntu package) - update to 5.4.0-56.62~18.04.1
linux-raspi (Ubuntu package) - update to 5.4.0-1023.26
linux-aws-5.4 (Ubuntu package) - update to 5.4.0-1030.31~18.04.1
linux-azure-5.4 (Ubuntu package) - update to 5.4.0-1032.33~18.04.1
linux-gcp-5.4 (Ubuntu package) - update to 5.4.0-1030.32~18.04.1
linux-oracle-5.4 (Ubuntu package) - update to 5.4.0-1030.32~18.04.1
linux-raspi-5.4 (Ubuntu package) - update to 5.4.0-1023.26~18.04.1
linux-oem-5.6 (Ubuntu package) - update to 5.6.0-1048.52
kernel-debug-devel - update to 4.18.0-372.13.1
kernel-abi-stablelists - update to 4.18.0-372.13.1
python3-perf - update to 4.18.0-372.13.1
perf - update to 4.18.0-372.13.1
kernel-tools-libs - update to 4.18.0-372.13.1
kernel-tools - update to 4.18.0-372.13.1
kernel-modules-extra - update to 4.18.0-372.13.1
kernel-modules - update to 4.18.0-372.13.1
kernel-headers - update to 4.18.0-372.13.1
kernel-devel - update to 4.18.0-372.13.1
kernel-debug-modules-extra - update to 4.18.0-372.13.1
kernel-debug-modules - update to 4.18.0-372.13.1
kernel-debug-core - update to 4.18.0-372.13.1
kernel-debug - update to 4.18.0-372.13.1
kernel-cross-headers - update to 4.18.0-372.13.1
kernel-core - update to 4.18.0-372.13.1
kernel - update to 4.18.0-372.13.1
bpftool - update to 4.18.0-372.13.1
kernel-doc - update to 4.18.0-372.13.1
python3-perf-debuginfo - update to 4.19.90-2012.5.0.0054
bpftool-debuginfo - update to 4.19.90-2012.5.0.0054
python3-perf - update to 4.19.90-2012.5.0.0054
python2-perf - update to 4.19.90-2012.5.0.0054
perf - update to 4.19.90-2012.5.0.0054
kernel-tools-devel - update to 4.19.90-2012.5.0.0054
kernel-devel - update to 4.19.90-2012.5.0.0054
kernel-tools-debuginfo - update to 4.19.90-2012.5.0.0054
python2-perf-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-source - update to 4.19.90-2012.5.0.0054
perf-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-tools - update to 4.19.90-2012.5.0.0054
kernel-debugsource - update to 4.19.90-2012.5.0.0054
bpftool - update to 4.19.90-2012.5.0.0054
kernel - update to 4.19.90-2012.5.0.0054
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.3
linux-image-4.15.0-128-lowlatency (Ubuntu package) - addressed in versions 4.15.0-128.131~16.04.1, 4.15.0-128.131
linux-image-4.15.0-128-generic-lpae (Ubuntu package) - addressed in versions 4.15.0-128.131~16.04.1, 4.15.0-128.131
linux-image-4.15.0-128-generic (Ubuntu package) - addressed in versions 4.15.0-128.131~16.04.1, 4.15.0-128.131
linux-image-4.15.0-1061-oracle (Ubuntu package) - addressed in versions 4.15.0-1061.67~16.04.1, 4.15.0-1061.67
linux-image-4.15.0-1076-gke (Ubuntu package) - update to 4.15.0-1076.81
linux-image-4.15.0-1081-kvm (Ubuntu package) - update to 4.15.0-1081.83
linux-image-4.15.0-1090-aws (Ubuntu package) - addressed in versions 4.15.0-1090.95~16.04.1, 4.15.0-1090.95
linux-image-4.15.0-1090-gcp (Ubuntu package) - addressed in versions 4.15.0-1090.103~16.04.1, 4.15.0-1090.103
linux-image-4.15.0-1093-snapdragon (Ubuntu package) - update to 4.15.0-1093.102
linux-image-4.15.0-1102-azure (Ubuntu package) - addressed in versions 4.15.0-1102.113~16.04.1, 4.15.0-1102.113
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.128.115, 5.4.0.58.61, 5.8.0.31.36, 5.8.0.33.38
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.128.115, 5.4.0.58.61, 5.8.0.31.36, 5.8.0.33.38
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.128.115, 5.4.0.58.61, 5.8.0.31.36, 5.8.0.33.38
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.128.115, 5.4.0.58.61, 5.8.0.31.36, 5.8.0.33.38
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.128.127
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.128.127
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.128.127, 5.4.0.58.61, 5.4.0.58.64~18.04.53
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.128.127
linux-image-generic-lpae-hwe-16.04 (Ubuntu package) - update to 4.15.0.128.127
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1061.50, 5.4.0.1032.29, 5.4.0.1033.16, 5.8.0.1011.11, 5.8.0.1013.13
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1061.71
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1076.80
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1076.80, 4.15.0.1090.91, 5.4.0.1032.41, 5.8.0.1012.12, 5.8.0.1014.14
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1081.77, 5.4.0.1030.28, 5.8.0.1011.12, 5.8.0.1013.15
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1090.84
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1090.91, 5.4.0.1032.20, 5.4.0.1032.41, 5.8.0.1012.12, 5.8.0.1014.14
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1090.92
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1090.108
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1093.96
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1102.75
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1102.95, 5.4.0.1034.16, 5.4.0.1034.32, 5.8.0.1013.13, 5.8.0.1015.15
linux-image-5.4.0-58-lowlatency (Ubuntu package) - update to 5.4.0-58.64~18.04.1
linux-image-5.4.0-58-generic-lpae (Ubuntu package) - update to 5.4.0-58.64~18.04.1
linux-image-5.4.0-58-generic (Ubuntu package) - update to 5.4.0-58.64~18.04.1
linux-image-5.4.0-1025-raspi (Ubuntu package) - update to 5.4.0-1025.28~18.04.1
linux-image-5.4.0-1030-kvm (Ubuntu package) - update to 5.4.0-1030.31
linux-image-5.4.0-1032-aws (Ubuntu package) - update to 5.4.0-1032.33~18.04.1
linux-image-5.4.0-1032-gcp (Ubuntu package) - update to 5.4.0-1032.34~18.04.1
linux-image-5.4.0-1032-oracle (Ubuntu package) - update to 5.4.0-1032.34
linux-image-5.4.0-1033-oracle (Ubuntu package) - update to 5.4.0-1033.35
linux-image-5.4.0-1034-azure (Ubuntu package) - update to 5.4.0-1034.35~18.04.1
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.58.61, 5.4.0.58.64~18.04.53
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.58.64~18.04.53
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.58.64~18.04.53
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.58.64~18.04.53
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.58.64~18.04.53
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.58.64~18.04.53
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1025.29
linux-image-raspi (Ubuntu package) - addressed in versions 5.4.0.1025.60, 5.8.0.1008.11, 5.8.0.1010.13
linux-image-raspi2 (Ubuntu package) - update to 5.4.0.1025.60
linux-image-aws (Ubuntu package) - addressed in versions 5.4.0.1032.17, 5.4.0.1032.33, 5.8.0.1014.16, 5.8.0.1016.18
linux-image-5.8.0-31-lowlatency (Ubuntu package) - update to 5.8.0-31.33
linux-image-5.8.0-31-generic-lpae (Ubuntu package) - update to 5.8.0-31.33
linux-image-5.8.0-31-generic-64k (Ubuntu package) - update to 5.8.0-31.33
linux-image-5.8.0-31-generic (Ubuntu package) - update to 5.8.0-31.33
linux-image-5.8.0-33-generic-lpae (Ubuntu package) - update to 5.8.0-33.36
linux-image-5.8.0-33-generic (Ubuntu package) - update to 5.8.0-33.36
linux-image-5.8.0-33-generic-64k (Ubuntu package) - update to 5.8.0-33.36
linux-image-5.8.0-33-lowlatency (Ubuntu package) - update to 5.8.0-33.36
linux-image-5.8.0-1008-raspi (Ubuntu package) - update to 5.8.0-1008.11
linux-image-5.8.0-1008-raspi-nolpae (Ubuntu package) - update to 5.8.0-1008.11
linux-image-5.8.0-1010-raspi-nolpae (Ubuntu package) - update to 5.8.0-1010.13
linux-image-5.8.0-1010-raspi (Ubuntu package) - update to 5.8.0-1010.13
linux-image-5.8.0-1011-oracle (Ubuntu package) - update to 5.8.0-1011.11
linux-image-5.8.0-1011-kvm (Ubuntu package) - update to 5.8.0-1011.12
linux-image-5.8.0-1012-gcp (Ubuntu package) - update to 5.8.0-1012.12
linux-image-5.8.0-1013-oracle (Ubuntu package) - update to 5.8.0-1013.13
linux-image-5.8.0-1013-kvm (Ubuntu package) - update to 5.8.0-1013.14
linux-image-5.8.0-1013-azure (Ubuntu package) - update to 5.8.0-1013.14
linux-image-5.8.0-1014-gcp (Ubuntu package) - update to 5.8.0-1014.14
linux-image-5.8.0-1014-aws (Ubuntu package) - update to 5.8.0-1014.15
linux-image-5.8.0-1015-azure (Ubuntu package) - update to 5.8.0-1015.16
linux-image-5.8.0-1016-aws (Ubuntu package) - update to 5.8.0-1016.17
linux-image-generic-64k (Ubuntu package) - addressed in versions 5.8.0.31.36, 5.8.0.33.38
linux-image-oem-20.04 (Ubuntu package) - addressed in versions 5.8.0.31.36, 5.8.0.33.38
linux-image-raspi-nolpae (Ubuntu package) - addressed in versions 5.8.0.1008.11, 5.8.0.1010.13

External References

Related Security Bulletins