Vulnerabilities > CVE-2020-25656 - Use After Free vulnerability in multiple products
Attack vector
LOCAL Attack complexity
HIGH Privileges required
HIGH Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- https://lkml.org/lkml/2020/10/29/528
- https://lkml.org/lkml/2020/10/16/84
- https://bugzilla.redhat.com/show_bug.cgi?id=1888726
- https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
- https://www.starwindsoftware.com/security/sw-20210325-0006/