Bug 1214919 (CVE-2020-27418) - VUL-0: CVE-2020-27418: kernel: user after free via vgacon_invert_region() function
Summary: VUL-0: CVE-2020-27418: kernel: user after free via vgacon_invert_region() fun...
Status: RESOLVED FIXED
Alias: CVE-2020-27418
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/375995/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-04 06:15 UTC by Alexander Bergmann
Modified: 2023-09-04 06:21 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2023-09-04 06:15:30 UTC 
CVE-2020-27418

A Use After Free vulnerability was found in  vgacon_invert_region in drivers/video/console/vgacon.c in Low level VGA based console driver in Linux Kernel. In this flaw, a local privileged attacker may crash the system due to a missing sanity check and cause a denial of service problem.

References:

https://patchwork.freedesktop.org/patch/356372/
http://fedora.com

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27418
https://bugzilla.redhat.com/show_bug.cgi?id=2236834
https://www.cve.org/CVERecord?id=CVE-2020-27418
http://fedora.com
https://patchwork.freedesktop.org/patch/356372/
Comment 1 Alexander Bergmann 2023-09-04 06:21:40 UTC 
Already fixed in all SUSE and openSUSE.

https://github.com/openSUSE/kernel/commit/513dc792d6060d5ef572e43852683097a8420f56

Closing bug as fixed.