CVE-2020-25668: debian debian_linux
Modified
AliasesSUSE-SU-2020:3698-1UBUNTU-CVE-2020-25668DEBIAN-CVE-2020-25668
Published 26-05-2021Last modified 04-08-2024
Vulnerability summary
CVE-2020-25668 is a high (CVSS 7.0) vulnerability in debian debian_linux. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.6% of scored vulnerabilities. 2 public exploits are recorded.
Priority
Prioritisepublic exploit
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?CVSS score
7.0/10
010
High · v3.1 (NVD)EPSS score
1.03%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2reference
Advisory lineage
Upstream 0 · Downstream 32 · Related 28DLA-2483-1DLA-2494-1MGASA-2021-0030MGASA-2021-0031OPENSUSE-SU-2020:1906-1OPENSUSE-SU-2020:2112-1OPENSUSE-SU-2020:2260-1OPENSUSE-SU-2021:0242-1OPENSUSE-SU-2024:10728-1OPENSUSE-SU-2024:13704-1SUSE-SU-2020:3484-1SUSE-SU-2020:3503-1SUSE-SU-2020:3507-1SUSE-SU-2020:3512-1SUSE-SU-2020:3513-1SUSE-SU-2020:3522-1SUSE-SU-2020:3532-1SUSE-SU-2020:3544-1SUSE-SU-2020:3648-1SUSE-SU-2020:3651-1SUSE-SU-2020:3670-1SUSE-SU-2020:3690-1SUSE-SU-2020:3713-1SUSE-SU-2020:3715-1SUSE-SU-2020:3717-1SUSE-SU-2020:3748-1SUSE-SU-2021:0437-1SUSE-SU-2021:14630-1USN-4679-1USN-4680-1USN-4681-1USN-4751-1
Timeline
- 26-05-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.0Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 6.9Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
1.03%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.03% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-662Improper SynchronizationThe product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
Affected systems
Version check
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu46 products
- linuxAll versions (No fix recorded) | < 4.4.0-198.230 | < 4.15.0-129.132 | < 5.4.0-59.65
- linux-aws< 4.4.0-1083.87 | < 4.4.0-1119.133 | < 4.15.0-1091.96 | < 5.4.0-1034.35
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1034.35~18.04.1
Debian2 products
- linux< 5.9.6-1
- debian_linuxEOL9.0
Suse2 products
- kernel-livepatch-SLE15-SP2_Update_7&distro=SUSE Linux Enterprise Live Patching 15 SP2< 2-2.1
- kgraft-patch-SLE12-SP5_Update_12&distro=SUSE Linux Enterprise Live Patching 12 SP5< 2-2.1
Linux1 product
- linux_kernel< 4.4.242 | ≥ 4.5, < 4.9.242 | ≥ 4.10, < 4.14.204 | ≥ 4.15, < 4.19.155 | ≥ 4.20, < 5.4.75 | ≥ 5.5, < 5.9.5
5 vendors · 64 products
References
20 links- www.openwall.com/lists/oss-security/2020/10/30/1Mailing ListX Refsource MLISTExploitPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2020/11/04/3Mailing ListX Refsource MLISTExploitPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2020/12/msg00015.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2020/12/msg00027.htmlMailing ListX Refsource MLISTThird Party Advisory
- www.openwall.com/lists/oss-security/2020/11/04/3%2CX Refsource MISC
- www.openwall.com/lists/oss-security/2020/10/30/1%2CX Refsource MISC
- bugzilla.redhat.com/show_bug.cgi?id=1893287%2CX Refsource MISC