CVE-2020-14331 is a Linux kernel vulnerability affecting VGA console implementations, specifically within the invert video code. A local attacker can trigger an out-of-bounds write by resizing the console via an ioctl VT_RESIZE call, leading to system crashes and potential privilege escalation. Rated 6.6 MEDIUM (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this flaw primarily impacts data confidentiality, integrity, and system availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 5.7.19CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
5.8.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.8.0:rc1:*:*:*:*:*:* | ||
5.8.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.8.0:rc2:*:*:*:*:*:* | ||
5.8.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.8.0:rc3:*:*:*:*:*:* | ||
5.8.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.8.0:rc4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console calling an ioctl VT_RESIZE which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Sep 8, 2020kernel: kernel: buffer over write in vgacon_scroll
Jul 28, 2020