CVE-2019-19252 - kernel: vcs_write in drivers/tty/vt/vc_screen.c does not prevent write access to vcsu devices

HIGH

kernel: vcs_write in drivers/tty/vt/vc_screen.c does not prevent write access to vcsu devices

Published Nov 25, 2019

7.8

HIGH

CVSS 3.1

EPSS 0.41%

vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a.

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-alt	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise MRG 2	kernel-rt	Not affected	n/a

Red Hat mitigation

At this time there is no workaround that is suitable for a production system that would completely mitigate this flaw.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-862

Missing Authorization

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-19252		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1778860		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8878		Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-testing&id=0c9acb1af77a3cb8707e43f45b72c95266903cee		x_refsource_MISCPatchVendor Advisory
https://lore.kernel.org/lkml/c30fc539-68a8-65d7-226c-6f8e6fd8bdfb%40suse.com/		x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2019-19252
https://security.netapp.com/advisory/ntap-20200103-0001/		x_refsource_CONFIRM
https://usn.ubuntu.com/4258-1/		vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/4284-1/		vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2019-19252