Integer overflow in Linux kernel - CVE-2020-13974

Vulnerability identifier: #VU64946

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-13974

CWE-ID: CWE-190

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow within drivers/tty/vt/keyboard.c if k_ascii is called several times in a row. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.

Linux kernel
Anolis OS
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
Ubuntu
Migration Toolkit for Containers
linux-image-generic (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-4.15.0-115-generic (Ubuntu package)
linux-image-4.15.0-115-generic-lpae (Ubuntu package)
linux-image-4.15.0-115-lowlatency (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1051-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1067-gke (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.15.0-1068-raspi2 (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1072-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1080-aws (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-4.15.0-1081-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1084-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-edge (Ubuntu package)
linux-image-4.15.0-1093-azure (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-4.15.0-1094-oem (Ubuntu package)
kernel
kernel-doc
kernel-abi-stablelists
python3-perf
perf
kernel-tools-libs
kernel-tools
kernel-modules-extra
kernel-modules
kernel-headers
kernel-devel
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-devel
kernel-debug-core
kernel-debug
kernel-cross-headers
kernel-core
bpftool
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-tools-libs-devel
python-perf
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-45-generic-lpae (Ubuntu package)
linux-image-5.4.0-45-lowlatency (Ubuntu package)
linux-image-5.4.0-45-generic (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1016-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-aws-edge (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-5.4.0-1022-oracle (Ubuntu package)
linux-image-5.4.0-1022-gcp (Ubuntu package)
linux-image-5.4.0-1022-aws (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.4.0-1023-azure (Ubuntu package)
IBM RackSwitch G7028
IBM RackSwitch G8332
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch
IBM Flex System EN2092 1Gb Ethernet Scalable Switch
IBM RackSwitch G8264CS
G8264CS_SI_Fabric_Image
IBM Flex System CN4093 10Gb Converged Scalable Switch
IBM RackSwitch G8264T
IBM RackSwitch G8316
IBM RackSwitch G8124E
IBM RackSwitch G8124
IBM RackSwitch G8264
IBM RackSwitch G8052
Flex System Fabric EN4093/EN4093R 10Gb Scalable Switch

Install updates from vendor's website.

Linux kernel - update to 5.7.2
Migration Toolkit for Containers - update to 1.7.2
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.115.103, 5.4.0.45.49
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.115.103, 5.4.0.45.49
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.115.103, 5.4.0.45.49
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.115.103, 5.4.0.45.49
linux-image-4.15.0-115-generic (Ubuntu package) - update to 4.15.0-115.116~16.04.1
linux-image-4.15.0-115-generic-lpae (Ubuntu package) - update to 4.15.0-115.116~16.04.1
linux-image-4.15.0-115-lowlatency (Ubuntu package) - update to 4.15.0-115.116~16.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1051.42, 5.4.0.1022.7, 5.4.0.1022.20
linux-image-4.15.0-1051-oracle (Ubuntu package) - addressed in versions 4.15.0-1051.55, 4.15.0-1051.55~16.04.1
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1051.62
linux-image-4.15.0-1067-gke (Ubuntu package) - update to 4.15.0-1067.70
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1067.71
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1067.71, 4.15.0.1081.83, 5.4.0.1022.20
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.15.0.1068.66, 5.4.0.1016.51
linux-image-4.15.0-1068-raspi2 (Ubuntu package) - update to 4.15.0-1068.72
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1072.68, 5.4.0.1021.20
linux-image-4.15.0-1072-kvm (Ubuntu package) - update to 4.15.0-1072.73
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1080.77
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1080.82
linux-image-4.15.0-1080-aws (Ubuntu package) - addressed in versions 4.15.0-1080.84, 4.15.0-1080.84~16.04.1
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1081.83, 5.4.0.1022.9, 5.4.0.1022.20
linux-image-4.15.0-1081-gcp (Ubuntu package) - addressed in versions 4.15.0-1081.92, 4.15.0-1081.92~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1081.99
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1084.87
linux-image-4.15.0-1084-snapdragon (Ubuntu package) - update to 4.15.0-1084.92
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1093.67
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1093.70, 4.15.0.1093.88, 5.4.0.1023.7, 5.4.0.1023.22
linux-image-azure-edge (Ubuntu package) - update to 4.15.0.1093.88
linux-image-4.15.0-1093-azure (Ubuntu package) - addressed in versions 4.15.0-1093.103, 4.15.0-1093.103~14.04.1, 4.15.0-1093.103~16.04.1
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.1094.98, 5.4.0.45.49
linux-image-4.15.0-1094-oem (Ubuntu package) - update to 4.15.0-1094.104
kernel - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4, 4.19.91-26
kernel-doc - update to 4.18.0-372.9.1
kernel-abi-stablelists - update to 4.18.0-372.9.1
python3-perf - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4
perf - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4, 4.19.91-26
kernel-tools-libs - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4, 4.19.91-26
kernel-tools - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4, 4.19.91-26
kernel-modules-extra - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4
kernel-modules - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4
kernel-headers - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4, 4.19.91-26
kernel-devel - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4, 4.19.91-26
kernel-debug-modules-extra - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4
kernel-debug-modules - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4
kernel-debug-devel - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4, 4.19.91-26
kernel-debug-core - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4
kernel-debug - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4, 4.19.91-26
kernel-cross-headers - update to 4.18.0-372.9.1
kernel-core - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4
bpftool - addressed in versions 4.18.0-372.9.1, 4.19.91-23.4, 4.19.91-26
kernel (Red Hat package) - update to 4.18.0-372.9.1.el8
kernel-rt (Red Hat package) - update to 4.18.0-372.9.1.rt7.166.el8
kernel-tools-libs-devel - addressed in versions 4.19.91-23.4, 4.19.91-26
python-perf - update to 4.19.91-26
linux-image-oem-osp1 (Ubuntu package) - update to 5.4.0.45.49
linux-image-5.4.0-45-generic-lpae (Ubuntu package) - update to 5.4.0-45.49~18.04.2
linux-image-5.4.0-45-lowlatency (Ubuntu package) - update to 5.4.0-45.49~18.04.2
linux-image-5.4.0-45-generic (Ubuntu package) - update to 5.4.0-45.49~18.04.2
linux-image-gkeop-5.4 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-5.4.0-1016-raspi (Ubuntu package) - update to 5.4.0-1016.17~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1016.20
linux-image-raspi (Ubuntu package) - update to 5.4.0.1016.51
linux-image-aws-edge (Ubuntu package) - update to 5.4.0.1022.8
linux-image-gke-5.4 (Ubuntu package) - update to 5.4.0.1022.9
linux-image-5.4.0-1022-oracle (Ubuntu package) - update to 5.4.0-1022.22~18.04.1
linux-image-5.4.0-1022-gcp (Ubuntu package) - update to 5.4.0-1022.22~18.04.1
linux-image-5.4.0-1022-aws (Ubuntu package) - update to 5.4.0-1022.22~18.04.1
linux-image-aws (Ubuntu package) - update to 5.4.0.1022.23
linux-image-5.4.0-1023-azure (Ubuntu package) - update to 5.4.0-1023.23~18.04.1
IBM RackSwitch G7028 - update to 7.6.7.0
IBM RackSwitch G8332 - update to 7.7.35.0
Flex System Fabric EN4093/EN4093R 10Gb Scalable Switch - update to 7.8.27.0
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch - update to 7.8.27.0
IBM Flex System EN2092 1Gb Ethernet Scalable Switch - update to 7.8.27.0
IBM RackSwitch G8264CS - update to 7.8.27.0
G8264CS_SI_Fabric_Image - update to 7.8.27.0
IBM Flex System CN4093 10Gb Converged Scalable Switch - update to 7.8.27.0
IBM RackSwitch G8264T - update to 7.9.29.0
IBM RackSwitch G8316 - update to 7.9.29.0
IBM RackSwitch G8124E - update to 7.11.19.0
IBM RackSwitch G8124 - update to 7.11.19.0
IBM RackSwitch G8264 - update to 7.11.19.0
IBM RackSwitch G8052 - update to 7.11.19.0

• https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=dad0bf9ce93fa40b667eccd3306783f4db4b932b
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b86dab054059b970111b5516ae548efaae5b3aae

• Integer overflow in Linux kernel
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC)
• Red Hat Enterprise Linux 8 update for kernel-rt
• Red Hat Enterprise Linux 8 update for kernel
• Multiple vulnerabilities in IBM RackSwitch firmware products
• Multiple vulnerabilities in IBM Flex System switch firmware products
• Anolis OS update for kernel(ANCK)4.19
• Anolis OS update for kernel
• Anolis OS update for kernel(ANCK)4.19
• Ubuntu update for linux
• Ubuntu update for linux