CVE-2020-13974
📋 TL;DR
This CVE describes an integer overflow vulnerability in the Linux kernel's keyboard driver (drivers/tty/vt/keyboard.c) that could potentially lead to privilege escalation or denial of service. The vulnerability affects Linux kernel versions 4.4 through 5.7.1, though community members argue it may not be exploitable for security impact. Systems using affected kernel versions with virtual terminal functionality are potentially vulnerable.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, kernel panic causing system crash, or arbitrary code execution in kernel context
Likely Case
Kernel panic leading to denial of service (system crash) requiring reboot
If Mitigated
No impact if kernel is patched or workarounds applied
🎯 Exploit Status
Requires local access and specific conditions to trigger the integer overflow multiple times in sequence
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.7.2 and later, backported to stable branches
Vendor Advisory: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b86dab054059b970111b5516ae548efaae5b3aae
Restart Required: Yes
Instructions:
1. Update kernel to version 5.7.2 or later. 2. For older stable branches, apply the backported patch from your distribution vendor. 3. Reboot the system to load the new kernel.
🔧 Temporary Workarounds
Disable virtual terminal access
linuxRestrict access to virtual terminals to prevent triggering the vulnerable code path
chmod 600 /dev/tty*
set restrictive permissions on virtual terminal devices
Use kernel module blacklisting
linuxPrevent loading of vulnerable keyboard modules if not needed
echo 'blacklist keyboard' >> /etc/modprobe.d/blacklist.conf
🧯 If You Can't Patch
- Restrict local user access to systems with vulnerable kernels
- Implement strict access controls and monitoring for virtual terminal usage
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r and compare to affected range 4.4-5.7.1Check Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.7.2 or later, or check for applied patches in distribution security updates📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/log/kern.log or dmesg
- Multiple rapid keyboard input events from single user
Network Indicators:
- None - local vulnerability only
SIEM Query:
source="kern.log" AND "kernel panic" OR "Oops" AND process="keyboard"🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=dad0bf9ce93fa40b667eccd3306783f4db4b932b
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b86dab054059b970111b5516ae548efaae5b3aae
- https://lists.debian.org/debian-lts-announce/2020/08/msg00019.html
- https://lkml.org/lkml/2020/3/22/482
- https://usn.ubuntu.com/4427-1/
- https://usn.ubuntu.com/4439-1/
- https://usn.ubuntu.com/4440-1/
- https://usn.ubuntu.com/4483-1/
- https://usn.ubuntu.com/4485-1/
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=dad0bf9ce93fa40b667eccd3306783f4db4b932b
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b86dab054059b970111b5516ae548efaae5b3aae
- https://lists.debian.org/debian-lts-announce/2020/08/msg00019.html
- https://lkml.org/lkml/2020/3/22/482
- https://usn.ubuntu.com/4427-1/
- https://usn.ubuntu.com/4439-1/
- https://usn.ubuntu.com/4440-1/
- https://usn.ubuntu.com/4483-1/
- https://usn.ubuntu.com/4485-1/
- https://www.oracle.com/security-alerts/cpujul2022.html
