CVE-2020-14331: linux linux_kernel Out-of-bounds Write
Vulnerability summary
CVE-2020-14331 is a high (CVSS 7.2) Out-of-bounds Write vulnerability in linux linux_kernel. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.6, physical access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 46 · Related 40Timeline
- 15-09-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · DebianEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.6MediumCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.56% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: physical access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu23 products
- linuxAll versions (No fix recorded)
- linux-awsAll versions (No fix recorded)
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-fips< 4.15.0-2027.27 | All versions (No fix recorded) | < 5.4.0-1069.73+fips2
Debian1 product
- linux< 5.7.17-1
Linux1 product
- linux_kernel≤ 5.7.19 | 5.8.0:rc1 | 5.8.0:rc2 | 5.8.0:rc3 | 5.8.0:rc4 | 5.8.0:rc5 | 5.8.0:rc6
Redhat1 product
- enterprise_linuxEOL7.0 | 8.0
Suse1 product
- kernel-livepatch-SLE15-SP2_Update_1&distro=SUSE Linux Enterprise Live Patching 15 SP2< 2-2.3
5 vendors · 27 products
References
13 links- www.openwall.com/lists/oss-security/2020/07/28/2X Refsource MISCREPORTExploitMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
