Linux Kernel up to 5.9 KDGKBSENT/KDSKBSENT vt_do_kdgkb_ioctl race condition

Summaryinfo

A vulnerability described as very critical has been identified in Linux Kernel up to 5.9. Affected is the function vt_do_kdgkb_ioctl of the component KDGKBSENT/KDSKBSENT. Executing a manipulation can lead to race condition. This vulnerability is tracked as CVE-2020-25656. The attack can be launched remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 5.9 (Operating System) and classified as very critical. This vulnerability affects the function vt_do_kdgkb_ioctl of the component KDGKBSENT/KDSKBSENT. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 10/16/2020 as Linux kernel concurrency UAF in vt_do_kdgkb_ioctl. The advisory is shared for download at seclists.org. This vulnerability was named CVE-2020-25656. The exploitation appears to be easy. The attack can be initiated remotely. Technical details and also a public exploit are known. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/19/2020).

It is possible to download the exploit at seclists.org. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1082: Linux kernel concurrency UAF in vt_do_kdgkb_ioctl (by CSieberg)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion