CVE-2020-14331: 
Sysdig vulnerability analysis and mitigation

A vulnerability (CVE-2020-14331) was discovered in the Linux kernel's implementation of the VGA console's invert video code. The flaw occurs when a local attacker attempts to resize the console by calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This vulnerability was discovered in July 2020 and affects Linux kernel versions prior to v5.8-rc7 (OpenWall, CVE Mitre).

The vulnerability exists in the vgacon_scrollback_update function within drivers/video/console/vgacon.c. The issue occurs due to insufficient bounds checking when handling the scrollback buffer. When the VT size is changed through VT_RESIZE, the new line might not fit at the end of the scrollback buffer in the next attempt to scroll, leading to an out-of-bounds write. The vulnerability is only exploitable when CONFIG_VGACON_SOFT_SCROLLBACK is enabled in the kernel configuration (OpenWall).

This vulnerability allows a local user with access to the VGA console to crash the system, potentially escalating their privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE Mitre).

The vulnerability requires local access to the system and the ability to access the VGA console. Additionally, the system must have CONFIG_VGACON_SOFT_SCROLLBACK enabled in the kernel configuration. A proof-of-concept exploit has been publicly disclosed that demonstrates how the vulnerability can be triggered using a specially crafted VT_RESIZE ioctl call (OpenWall).

The vulnerability was fixed in Linux kernel version v5.8-rc7 with commit 92ed301919932f777713b9172e525674157e983d. The fix involves adding proper bounds checking before the loop in vgacon_scrollback_update to ensure the line fits in the buffer. Various Linux distributions have also released patches for their supported kernel versions, including Debian with versions 4.19.146-1~deb9u1 and 4.9.240-1 (Debian LTS, Linux Kernel).