CVE-2020-12464

Published: Apr 29, 2020Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.

Affected (23)

Products: Linux: Linux Kernel · Netapp: Active Iq Unified Manager, Aff A700s, Cloud Backup, Hci Baseboard Management Controller, Hci Compute Node, Hci Storage Nodes, Solidfire & Hci Storage Node, Solidfire Baseboard Management Controller, Steelstore Cloud Integrated Storage

1 product

9 products

Active Iq Unified Manager

Hci Baseboard Management Controller

Hci Compute Node

Hci Storage Nodes

Solidfire & Hci Storage Node

Solidfire Baseboard Management Controller

Steelstore Cloud Integrated Storage

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 3.16.85
Linux Linux Kernel	From 3.17 to 4.4.221
Linux Linux Kernel	From 4.10 to 4.14.178
Linux Linux Kernel	From 4.15 to 4.19.119
Linux Linux Kernel	From 4.20 to 5.4.36
Linux Linux Kernel	From 4.5 to 4.9.221
Linux Linux Kernel	From 5.5 to 5.6.8

Configuration B

16 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Aff A700s	All versions
Netapp Cloud Backup	All versions
Netapp Hci Baseboard Management Controller	Version h300s
Netapp Hci Baseboard Management Controller	Version h410c
Netapp Hci Baseboard Management Controller	Version h410s
Netapp Hci Baseboard Management Controller	Version h500s
Netapp Hci Baseboard Management Controller	Version h610c
Netapp Hci Baseboard Management Controller	Version h610s
Netapp Hci Baseboard Management Controller	Version h615c
Netapp Hci Baseboard Management Controller	Version h700s
Netapp Hci Compute Node	All versions
Netapp Hci Storage Nodes	All versions
Netapp Solidfire & Hci Storage Node	All versions
Netapp Solidfire Baseboard Management Controller	All versions
Netapp Steelstore Cloud Integrated Storage	All versions

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (34)

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html

Source: cve@mitre.org

Third Party Advisory

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8

Source: cve@mitre.org

Release NotesVendor Advisory

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=056ad39ee9253873522f6469c3364964a322912b

Source: cve@mitre.org

PatchVendor Advisory

https://github.com/torvalds/linux/commit/056ad39ee9253873522f6469c3364964a322912b

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html

Source: cve@mitre.org

Third Party Advisory

https://lkml.org/lkml/2020/3/23/52

Source: cve@mitre.org

ExploitVendor Advisory

https://patchwork.kernel.org/patch/11463781/

Source: cve@mitre.org

PatchVendor Advisory

https://security.netapp.com/advisory/ntap-20200608-0001/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4387-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4388-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4389-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4390-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4391-1/

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://www.debian.org/security/2020/dsa-4698

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://www.debian.org/security/2020/dsa-4699

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=056ad39ee9253873522f6469c3364964a322912b

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://github.com/torvalds/linux/commit/056ad39ee9253873522f6469c3364964a322912b

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lkml.org/lkml/2020/3/23/52

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

https://patchwork.kernel.org/patch/11463781/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://security.netapp.com/advisory/ntap-20200608-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4387-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4388-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4389-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4390-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4391-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://www.debian.org/security/2020/dsa-4698

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://www.debian.org/security/2020/dsa-4699

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.