CVE-2020-25656

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-25656
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.

4.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.9 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1888726 Exploit Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html Mailing List Third Party Advisory
https://lkml.org/lkml/2020/10/16/84 Exploit Mailing List Third Party Advisory
https://lkml.org/lkml/2020/10/29/528 Mailing List Patch Third Party Advisory
https://www.starwindsoftware.com/security/sw-20210325-0006/ Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1888726 Exploit Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html Mailing List Third Party Advisory
https://lkml.org/lkml/2020/10/16/84 Exploit Mailing List Third Party Advisory
https://lkml.org/lkml/2020/10/29/528 Mailing List Patch Third Party Advisory
https://www.starwindsoftware.com/security/sw-20210325-0006/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc1:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12533:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12658:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12859:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13170:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13586:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13861:*:*:*:vsphere:*:*
History

21 Nov 2024, 05:18

Type Values Removed Values Added
References () https://bugzilla.redhat.com/show_bug.cgi?id=1888726 - Exploit, Issue Tracking, Patch, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=1888726 - Exploit, Issue Tracking, Patch, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html - Mailing List, Third Party Advisory
References () https://lkml.org/lkml/2020/10/16/84 - Exploit, Mailing List, Third Party Advisory () https://lkml.org/lkml/2020/10/16/84 - Exploit, Mailing List, Third Party Advisory
References () https://lkml.org/lkml/2020/10/29/528 - Mailing List, Patch, Third Party Advisory () https://lkml.org/lkml/2020/10/29/528 - Mailing List, Patch, Third Party Advisory
References () https://www.starwindsoftware.com/security/sw-20210325-0006/ - Third Party Advisory () https://www.starwindsoftware.com/security/sw-20210325-0006/ - Third Party Advisory

25 Oct 2022, 17:03

Type Values Removed Values Added
CPE cpe:2.3:a:starwindsoftware:starwind_virtual_san:-:*:*:*:*:vsphere:*:* cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12533:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13586:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13861:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13170:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12658:*:*:*:vsphere:*:*
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12859:*:*:*:vsphere:*:*

14 Oct 2022, 19:25

Type Values Removed Values Added
References
  • (MISC) https://www.starwindsoftware.com/security/sw-20210325-0006/ - Third Party Advisory
CPE cpe:2.3:a:starwindsoftware:starwind_virtual_san:-:*:*:*:*:vsphere:*:*

01 Apr 2022, 15:38

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:5.10:-:*:*:*:*:*:*
cpe:2.3:a:debian:debian_linux:9.0:*:*:*:*:*:*:*		 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

01 Jan 2022, 18:11

Type Values Removed Values Added
CPE cpe:2.3:a:debian:debian_linux:9.0:*:*:*:*:*:*:*
References (MLIST) https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html - (MLIST) https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html - Mailing List, Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html - (MLIST) https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html - Mailing List, Third Party Advisory
Information

Published : 2020-12-02 01:15

Updated : 2024-11-21 05:18

NVD link : CVE-2020-25656

Mitre link : CVE-2020-25656

CVE.ORG link : CVE-2020-25656

JSON object : View

Products Affected

starwindsoftware

  • starwind_virtual_san

redhat

  • enterprise_linux

linux

  • linux_kernel

debian

  • debian_linux
CWE
CWE-416

Use After Free