Loading vulnerability…
Linux Kernel VT Console Use-After-Free Read
CVE-2020-25656 is a use-after-free vulnerability in the Linux kernel virtual-terminal console subsystem. A race between the KDGKBSENT and KDSKBSENT ioctl operations can cause vt_do_kdgkb_ioctl to dereference freed memory while handling a keyboard-table read operation. This permits an authorized local attacker to perform an out-of-bounds kernel-memory read.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation primarily compromises confidentiality by disclosing out-of-bounds kernel memory to a local attacker. The documented CVSS v3.1 vector is AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting local access, high attack complexity, and a high-privilege requirement. Integrity modification and service availability impact are not identified.
If you can’t patch tonight, do this now.
Restrict local access to virtual-terminal consoles and ensure untrusted users and processes cannot obtain or retain CAP_SYS_TTY_CONFIG. Apply least-privilege controls to workloads that require terminal-management capabilities, including containers and service accounts. These controls reduce exploitability but do not replace installation of a fixed kernel.
Patch, then assume compromise.
Install the vendor-provided Linux kernel update and reboot so that the updated kernel is running. Red Hat fixed the standard RHEL 7 kernel in version 3.10.0-1160.21.1.el7 and the RHEL 7 real-time kernel in version 3.10.0-1160.21.1.rt56.1158.el7. Red Hat also issued fixes for RHEL 8 standard and real-time kernel packages in May 2024. Update affected container base images and rebuild dependent images where the image includes a vulnerable kernel userspace package inventory; host-kernel remediation remains necessary because containers use the host kernel. RHEL 7 kernel-alt is marked as will not fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.