medium 6.6

CVE-2020-14331 json

A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the…

published 2020-09-15 6y ago modified 2026-06-17 4mo ago also EUVD-2020-6479

cvss: 6.6; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits: 0; none known

A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Patch / fix

distros 5 links 1

debian ubuntu red hat suse opensuse

linux Debian 14, Debian 13, Debian 12 5.7.17-1

debian advisories DEBIAN-CVE-2020-14331

linux-fips Ubuntu Pro FIPS-updates 16.04 LTS 4.4.0-1046.51
linux-fips Ubuntu Pro FIPS-updates 18.04 LTS 4.15.0-1041.46
linux-aws-fips Ubuntu Pro FIPS-updates 18.04 LTS 4.15.0-2027.27
linux-aws-fips Ubuntu Pro FIPS-updates 20.04 LTS 5.4.0-1069.73+fips2
linux-gcp-fips Ubuntu Pro FIPS-updates 20.04 LTS 5.4.0-1067.71~20.04.1
linux-azure-fips Ubuntu Pro FIPS-updates 18.04 LTS 4.15.0-2009.10
linux-azure-fips Ubuntu Pro FIPS-updates 20.04 LTS 5.4.0-1073.76+fips1

ubuntu advisories UBUNTU-CVE-2020-14331

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 7 3.10.0-1160.6.1.el7
perf RHEL 7 3.10.0-1160.6.1.el7
bpftool RHEL 7 3.10.0-1160.6.1.el7
python-perf RHEL 7 3.10.0-1160.6.1.el7
kernel-kdump RHEL 7 3.10.0-1160.6.1.el7
kernel-tools RHEL 7 3.10.0-1160.6.1.el7
kernel-tools-libs RHEL 7 3.10.0-1160.6.1.el7
kernel-bootwrapper RHEL 7 3.10.0-1160.6.1.el7

red hat advisories RHSA-2020:5023 RHSA-2020:5026 RHSA-2020:4286 RHSA-2020:4289

kernel-rt Real Time Module 15 SP1 4.12.14-14.31.1
kernel-syms-rt Real Time Module 15 SP1 4.12.14-14.31.1
kernel-rt_debug Real Time Module 15 SP1 4.12.14-14.31.1
kernel-source-rt Real Time Module 15 SP1 4.12.14-14.31.1
kernel-syms SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.60.1
kernel-source SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.60.1
kernel-default SLES for SAP 12 SP4, SLES 12 SP4-LTSS, SLE Live Patching 12 SP4 +3 more 4.12.14-95.60.1
kernel-syms SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.58.1

suse advisories SUSE-SU-2021:14630-1 SUSE-SU-2020:2631-1 SUSE-SU-2020:2623-1 SUSE-SU-2020:2610-1 SUSE-SU-2020:2605-1 SUSE-SU-2020:2582-1

kernel-source openSUSE Tumbleweed 5.14.6-1.4
kernel-source openSUSE Tumbleweed 6.6.17-1.1
kernel-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-syms-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-rt_debug openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-source-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-syms openSUSE Leap 15.1 4.12.14-lp151.28.63.1
kernel-obs-qa openSUSE Leap 15.1 4.12.14-lp151.28.63.1

opensuse advisories openSUSE-SU-2024:10728-1 openSUSE-SU-2024:13704-1 openSUSE-SU-2021:0242-1 openSUSE-SU-2020:1325-1 openSUSE-SU-2020:1236-1 openSUSE-SU-2020:1153-1

lists.openwall.net/linux-kernel/2020/07/29/234 advisory

Is CVE-2020-14331 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-14331 updated 2026-11-07 cvss 6.6

kernel: kernel: buffer over write in vgacon_scroll

Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +3 more
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise MRG 2 kernel
affected: workaround, no fix planned “Out of support scope”
Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-193.28.1.el8_2, kernel-debuginfo-common-aarch64 4.18.0-193.28.1.el8_2, kernel-debuginfo-common-ppc64le 4.18.0-193.28.1.el8_2 Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-193.28.1.el8_2, kernel 4.18.0-193.28.1.el8_2, bpftool 4.18.0-193.28.1.el8_2, kernel-core 4.18.0-193.28.1.el8_2, kernel-tools 4.18.0-193.28.1.el8_2, python3-perf 4.18.0-193.28.1.el8_2, +15 more
fixed: vendor fix RHSA-2020:4286
Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1160.6.1.el7, kernel 3.10.0-1160.6.1.el7, bpftool 3.10.0-1160.6.1.el7, python-perf 3.10.0-1160.6.1.el7, kernel-tools 3.10.0-1160.6.1.el7, kernel-tools-libs 3.10.0-1160.6.1.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.6.1.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.6.1.el7
fixed: vendor fix RHSA-2020:5023
Red Hat Enterprise Linux for Real Time (v. 7) kernel-rt 3.10.0-1160.6.1.rt56.1139.el7, kernel-rt-trace 3.10.0-1160.6.1.rt56.1139.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.6.1.rt56.1139.el7 Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1160.6.1.rt56.1139.el7, kernel-rt-kvm 3.10.0-1160.6.1.rt56.1139.el7, kernel-rt-trace 3.10.0-1160.6.1.rt56.1139.el7, kernel-rt-debug-kvm 3.10.0-1160.6.1.rt56.1139.el7, kernel-rt-trace-kvm 3.10.0-1160.6.1.rt56.1139.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.6.1.rt56.1139.el7
fixed: vendor fix RHSA-2020:5026
Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-core 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-modules 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-debug-core 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-debug-modules 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-modules-extra 4.18.0-193.28.1.rt13.77.el8_2, +2 more Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-kvm 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-core 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-modules 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-debug-kvm 4.18.0-193.28.1.rt13.77.el8_2, kernel-rt-debug-core 4.18.0-193.28.1.rt13.77.el8_2, +4 more
fixed: vendor fix RHSA-2020:4289
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1160.6.1.el7, kernel 3.10.0-1160.6.1.el7, bpftool 3.10.0-1160.6.1.el7, python-perf 3.10.0-1160.6.1.el7, kernel-kdump 3.10.0-1160.6.1.el7, kernel-tools 3.10.0-1160.6.1.el7, +7 more Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1160.6.1.el7, kernel-debuginfo-common-x86_64 3.10.0-1160.6.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-1160.6.1.el7 Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-1160.6.1.el7, kernel 3.10.0-1160.6.1.el7, bpftool 3.10.0-1160.6.1.el7, python-perf 3.10.0-1160.6.1.el7, kernel-tools 3.10.0-1160.6.1.el7, kernel-tools-libs 3.10.0-1160.6.1.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.6.1.el7
fixed: vendor fix RHSA-2020:5023

show 1 more

Red Hat Enterprise Linux Client (v. 7) kernel-headers 3.10.0-1160.6.1.el7 Red Hat Enterprise Linux Server (v. 7) kernel-headers 3.10.0-1160.6.1.el7 Red Hat Enterprise Linux Workstation (v. 7) kernel-headers 3.10.0-1160.6.1.el7
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

openwall.com https://www.openwall.com/lists/oss-security/2020/07/28/2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.6	CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

n/a Linux Kernel

Classification

Weakness

CWE-787 Out-of-bounds Write

Technology feeds

Linux kernel rss critical rss

References

lists.openwall.net /linux-kernel/2020/07/29/234
mailing-list, patch, third-party-advisory
openwall.com /lists/oss-security/2020/07/28/2
exploit, mailing-list, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1858679
issue-tracking, third-party-advisory
lists.debian.org /debian-lts-announce/2020/09/msg00025.html
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2020/10/msg00032.html
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2020/10/msg00034.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2020-14331
NVD CVE-2020-14331

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed