A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36557.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ca4463bf8438b403596edd0ec961ca0d4fbe0220",
"digest": {
"function_hash": "82946497298552668832112826872816838554",
"length": 750.0
},
"id": "CVE-2020-36557-32dbd7e0",
"deprecated": false,
"target": {
"file": "drivers/tty/vt/vt.c",
"function": "con_install"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ca4463bf8438b403596edd0ec961ca0d4fbe0220",
"digest": {
"line_hashes": [
"73578576644173646830325769045121813182",
"159921162298486042975216425711514502957",
"57577575587501651950114850845932413257",
"327757540376742783742695793966566322392",
"192984061031875498799560611439505256113",
"219990070626352749348680368655168763576",
"40439700597846130776024088880342860887",
"267118870247722610308469858307543661356",
"157088342689485509255428894131600517013",
"213870834615271010709960151007661182755",
"167891176445276434754973946101374354782",
"187569880147908408092936455452613195275",
"320115222891856927347258160609320059809",
"224843292962200742949835397478756838117"
],
"threshold": 0.9
},
"id": "CVE-2020-36557-4df0c3f0",
"deprecated": false,
"target": {
"file": "drivers/tty/vt/vt_ioctl.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ca4463bf8438b403596edd0ec961ca0d4fbe0220",
"digest": {
"function_hash": "183566543791204655435674067324577776194",
"length": 308.0
},
"id": "CVE-2020-36557-7b50b83f",
"deprecated": false,
"target": {
"file": "drivers/tty/vt/vt_ioctl.c",
"function": "vt_disallocate"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ca4463bf8438b403596edd0ec961ca0d4fbe0220",
"digest": {
"function_hash": "149981108729376608389711429915901195947",
"length": 895.0
},
"id": "CVE-2020-36557-d37165dc",
"deprecated": false,
"target": {
"file": "drivers/tty/vt/vt.c",
"function": "vc_allocate"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ca4463bf8438b403596edd0ec961ca0d4fbe0220",
"digest": {
"line_hashes": [
"15132477503954926813328998508962184022",
"164171242803730179474851009959505915175",
"291912819189987968909878183681227478693",
"147679532854179727492285867739933357215",
"76368581593887961009750298684382314726",
"186848551058272626518465295308731469279",
"35384445944861147656768885306155181432",
"135404949096855513846628540763558301322",
"319267148941403241321045844756292016925",
"104593966526914459011680657517492936045",
"234128795621375549853048168578333568971",
"69801127853897249124958916009979665182",
"88985365233803889489406029367380744382",
"251148172797797446896611960300645286432",
"297809666927988095372408571826014699685",
"291824939437905654597822199888284265690",
"295154569210648802780259146794038819473",
"199053368976753161819240642921556591485"
],
"threshold": 0.9
},
"id": "CVE-2020-36557-d47ddbae",
"deprecated": false,
"target": {
"file": "drivers/tty/vt/vt.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ca4463bf8438b403596edd0ec961ca0d4fbe0220",
"digest": {
"function_hash": "445672033402529896773900384528618605",
"length": 411.0
},
"id": "CVE-2020-36557-f28f17e0",
"deprecated": false,
"target": {
"file": "drivers/tty/vt/vt_ioctl.c",
"function": "vt_disallocate_all"
}
}
]