{"id":"PUB-A-174904705","details":"In vt_do_kdgkb_ioctl of keyboard.c, there is a possible use after free read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-174904705","CVE-2020-25656"],"modified":"2026-04-14T15:05:17.852631Z","published":"2021-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-05-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/82e61c3909db51d91b9d3e2071557b6435018b80"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2021-05-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"severity":"Moderate","vanir_signatures":[{"signature_version":"v1","digest":{"length":2516,"function_hash":"110408221018334417520596095852485174859"},"id":"PUB-A-174904705-1047c464","target":{"truncated_path_level":1,"function":"vt_do_kdgkb_ioctl","file":"drivers/tty/vt/keyboard.c"},"source":"https://android.googlesource.com/kernel/common/+/82e61c3909db51d91b9d3e2071557b6435018b80","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["194275741008887581683660773592281145481","8315228988574000327071456939097433976","80600477583606619659672096950384974720","104857375737196067858664114120600498002","201901347788230331230696806230515149421","2675575038703807678240452601510427040","125133215507300073148428151418142485320","33269433147810158561824798089714149065","120651608584128343493135990292904560024","66292776179084018434320120933735435649","5046354201908593435931698324303028830","38580054058956432928299504579367400466","68439981818148735403637258396168443365","102072498919483881386871395440340172168","91483627167664302979667418767148165049"],"threshold":0.9},"id":"PUB-A-174904705-2fb767ef","target":{"truncated_path_level":1,"file":"drivers/tty/vt/keyboard.c"},"source":"https://android.googlesource.com/kernel/common/+/82e61c3909db51d91b9d3e2071557b6435018b80","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":294,"function_hash":"158862159774245439923770722094736757362"},"id":"PUB-A-174904705-3d77ffa0","target":{"truncated_path_level":1,"function":"k_fn","file":"drivers/tty/vt/keyboard.c"},"source":"https://android.googlesource.com/kernel/common/+/82e61c3909db51d91b9d3e2071557b6435018b80","signature_type":"Function","deprecated":false}],"fixes":["https://android.googlesource.com/kernel/common/+/82e61c3909db51d91b9d3e2071557b6435018b80"],"spl":"2021-05-05","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-174904705.json"}}],"schema_version":"1.7.5"}