CVE-2020-25656: 
Linux Kernel vulnerability analysis and mitigation

A flaw was discovered in the Linux kernel (CVE-2020-25656) where a use-after-free vulnerability was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. The vulnerability was discovered in October 2020 and affects Linux kernel versions from 3.4 to 5.9 (LKML Report).

The vulnerability stems from a race condition in KDGKBSENT and KDSKBSENT operations. The issue occurs when KDSKBSENT allocates a larger heap buffer to funcbufptr, and KDGKBSENT obtains the allocated heap pointer. Due to KDGKBSENT having no lock, KDSKBSENT can be used again to allocate a larger buffer, causing the old funcbufptr to be freed while still being referenced, resulting in a use-after-free condition (LKML Report). The vulnerability has been assigned a CVSS v3.1 base score of 4.1 (MEDIUM) with vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (NVD).

The primary impact of this vulnerability is to data confidentiality. A local user could exploit this flaw to gain read access to memory out of bounds. The vulnerability requires local access and high privileges, specifically the CAP_SYS_TTY_CONFIG capability, to be exploited (Redhat Bugzilla).

The vulnerability requires local access and the CAP_SYS_TTY_CONFIG capability to be exploited. For successful exploitation, CONFIG_KASAN (kernel memory debugger) needs to be enabled, which is typically disabled in production systems. Without CONFIG_KASAN, the bug occurs silently without causing a kernel crash (Redhat Bugzilla).

The issue was fixed in Linux kernel version 5.10-rc2. A patch was developed that reorders user buffer handling in vt_do_kdgkb_ioctl (LKML Patch). Various Linux distributions have released security updates to address this vulnerability, including Red Hat Enterprise Linux, Debian, and Ubuntu (Debian Advisory).