A vulnerability, which was classified as critical, was found in Linux Kernel up to 5.5.2 (Operating System). Affected is the function vgacon_invert_region of the file drivers/video/console/vgacon.c. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.

The weakness was shared 02/06/2020. This vulnerability is traded as CVE-2020-8649 since 02/06/2020. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 02/06/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-149753 and VDB-149752 are related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.5.0
• 5.5.1
• 5.5.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion