CVE-2020-28974

What it actually does

Slab out-of-bounds read in fbcon triggered by KD_FONT_OP_COPY ioctl in drivers/tty/vt/vt.c allowing local read of privileged kernel memory or kernel crash.

Why it matters to the business

Systems running vulnerable kernels face risk of local information disclosure or denial of service when an attacker has physical or high-privilege console access; widespread kernel deployments amplify exposure but require local access.

How an attack unfolds

An attacker with local console or root privileges issues a crafted KD_FONT_OP_COPY font operation through the vt subsystem to trigger the out-of-bounds slab read and extract kernel data or induce a crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 3c4e0dff2095c579b142d5a0693257f1c58b4804 (equivalent to 5.9.7 or later).

How to confirm the fix worked

Verify kernel version is at least 5.9.7, confirm the listed commit is present in the source tree, and test that KD_FONT_OP_COPY no longer permits out-of-bounds access.

Typical attack path

1. Obtain local or physical access to a Linux system
2. Acquire privileges sufficient to issue vt ioctls (typically root or console access)
3. Invoke KD_FONT_OP_COPY operation with manipulated font parameters
4. Read leaked slab memory contents or trigger kernel panic

How to detect it

Review kernel logs for oops or panic entries referencing fbcon, vt.c, or slab out-of-bounds reads; inspect audit logs for unusual KD_FONT_OP_COPY ioctl activity from untrusted local sessions.

What your security team should do

• Apply the kernel update containing commit 3c4e0dff2095c579b142d5a0693257f1c58b4804 immediately on all affected systems
• Restrict physical and console access to limit local attack surface
• Monitor kernel logs for fbcon or vt-related oops and panics