CVE-2020-15436

Published: Nov 23, 2020Modified: Nov 21, 2024

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.

Affected (24)

Products: Linux: Linux Kernel · Broadcom: Brocade Fabric Operating System Firmware · Netapp: Cloud Backup, Solidfire & Hci Management Node, Solidfire Baseboard Management Controller Firmware, H410c Firmware, H610c Firmware, H610s Firmware, H615c Firmware, A700s Firmware, Aff 8700 Firmware, Fas 8700 Firmware, Aff 8300 Firmware, Fas 8300 Firmware, Aff A400 Firmware, Fabric Attached Storage A400 Firmware, A250 Firmware, Aff 500f Firmware, Fas 500f Firmware

Linux

1 product

Linux Kernel

Broadcom

1 product

Brocade Fabric Operating System Firmware

Netapp

17 products

Cloud Backup

Solidfire & Hci Management Node

Solidfire Baseboard Management Controller Firmware

Fabric Attached Storage A400 Firmware

A250 Firmware

Aff 500f Firmware

Fas 500f Firmware

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 2.6.38 to 4.4.229
Linux Linux Kernel	From 4.10 to 4.14.186
Linux Linux Kernel	From 4.15 to 4.19.130
Linux Linux Kernel	From 4.20 to 5.4.49
Linux Linux Kernel	From 4.5 to 4.9.229
Linux Linux Kernel	From 5.5 to 5.7.6

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Broadcom Brocade Fabric Operating System Firmware	All versions

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Solidfire & Hci Management Node	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Solidfire Baseboard Management Controller Firmware	All versions

Running on/with	Platform Versions
Netapp Solidfire Baseboard Management Controller	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610c Firmware	All versions

Running on/with	Platform Versions
Netapp H610c	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610s Firmware	All versions

Running on/with	Platform Versions
Netapp H610s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H615c Firmware	All versions

Running on/with	Platform Versions
Netapp H615c	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A700s Firmware	All versions

Running on/with	Platform Versions
Netapp A700s	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Aff 8700 Firmware	All versions

Running on/with	Platform Versions
Netapp Aff 8700	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas 8700 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas 8700	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Aff 8300 Firmware	All versions

Running on/with	Platform Versions
Netapp Aff 8300	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas 8300 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas 8300	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Aff A400 Firmware	All versions

Running on/with	Platform Versions
Netapp Aff A400	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fabric Attached Storage A400 Firmware	All versions

Running on/with	Platform Versions
Netapp Fabric Attached Storage A400	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A250 Firmware	All versions

Running on/with	Platform Versions
Netapp A250	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Aff 500f Firmware	All versions

Running on/with	Platform Versions
Netapp Aff 500f	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas 500f Firmware	All versions

Running on/with	Platform Versions
Netapp Fas 500f	All versions

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (4)

https://lkml.org/lkml/2020/6/7/379

Source: securities@openeuler.org

ExploitPatchVendor Advisory

https://security.netapp.com/advisory/ntap-20201218-0002/

Source: securities@openeuler.org

Third Party Advisory

https://lkml.org/lkml/2020/6/7/379

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

https://security.netapp.com/advisory/ntap-20201218-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.