Bug 1214919 (CVE-2020-27418)

Summary:	VUL-0: CVE-2020-27418: kernel: user after free via vgacon_invert_region() function
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Alexander Bergmann <abergmann>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P5 - None	CC:	abergmann, security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/375995/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Alexander Bergmann 2023-09-04 06:15:30 UTC

CVE-2020-27418

A Use After Free vulnerability was found in  vgacon_invert_region in drivers/video/console/vgacon.c in Low level VGA based console driver in Linux Kernel. In this flaw, a local privileged attacker may crash the system due to a missing sanity check and cause a denial of service problem.

References:

https://patchwork.freedesktop.org/patch/356372/
http://fedora.com

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27418
https://bugzilla.redhat.com/show_bug.cgi?id=2236834
https://www.cve.org/CVERecord?id=CVE-2020-27418
http://fedora.com
https://patchwork.freedesktop.org/patch/356372/

Comment 1 Alexander Bergmann 2023-09-04 06:21:40 UTC

Already fixed in all SUSE and openSUSE.

https://github.com/openSUSE/kernel/commit/513dc792d6060d5ef572e43852683097a8420f56

Closing bug as fixed.