PT-2020-6553 · Linux+9 · Linux Kernel+9

Syzbot · Published 2020-09-25 · Updated 2022-06-30 · CVE-2020-28915

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.8.15

Description A buffer over-read issue exists in the fbcon code at the framebuffer layer, allowing local attackers to read kernel memory. This could potentially lead to a denial of service. The issue is related to the file drivers/video/fbdev/core/fbcon.c in the Linux kernel.

Recommendations For Linux kernel versions prior to 5.8.15, update to version 5.8.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the framebuffer layer to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2022:5316

ALSA-2022:5344

ALT-PU-2020-3058

ALT-PU-2020-3069

ALT-PU-2020-3210

ALT-PU-2020-3553

ALT-PU-2021-1083

ALT-PU-2021-1105

ALT-PU-2021-1621

ALT-PU-2021-1656

ALT-PU-2021-1739

ALT-PU-2021-1862

ALT-PU-2021-1866

ALT-PU-2021-1870

BDU:2021-06412

CESA-2022_5316

CESA-2022_5344

CVE-2020-28915

MGASA-2021-0030

MGASA-2021-0031

OPENSUSE-SU-2020:2034-1

OPENSUSE-SU-2020:2161-1

OPENSUSE-SU-2020:2260-1

OPENSUSE-SU-2020_2034-1

OPENSUSE-SU-2020_2161-1

OPENSUSE-SU-2020_2260-1

OPENSUSE-SU-2021:0242-1

OPENSUSE-SU-2021_0242-1

RHSA-2022:5316

RHSA-2022:5344

RHSA-2022_5316

RHSA-2022_5344

RLSA-2022:5316

RLSA-2022:5344

SUSE-SU-2020:3713-1

SUSE-SU-2020:3714-1

SUSE-SU-2020:3715-1

SUSE-SU-2020:3717-1

SUSE-SU-2020:3718-1

SUSE-SU-2020:3748-1

SUSE-SU-2020:3764-1

SUSE-SU-2020:3766-1

SUSE-SU-2020:3798-1

SUSE-SU-2021:0434-1

SUSE-SU-2021:0437-1

SUSE-SU-2021:0438-1

SUSE-SU-2021:0452-1

SUSE-SU-2021:14630-1

SUSE-SU-2021_14630-1

USN-4657-1

USN-4658-1

USN-4658-2

USN-4659-1

USN-4660-1

USN-4660-2

USN-4752-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Linux Kernel

Red Hat

Rocky Linux

Suse

Ubuntu

References · 1119

• https://ubuntu.com/security/CVE-2020-0427 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28588 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25645 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:2034-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29660 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25643 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27152 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25212 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28915 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5af08640795b2b9a940c9266c0260455377ae262 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4752-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15437 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0030.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-28915 · Vendor Advisory