exploitDog

CVE-2020-25669

Опубликовано: 26 мая 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.

Ссылки

http://www.openwall.com/lists/oss-security/2020/11/05/2
Exploit
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/11/20/5
Exploit
Mailing List
Third Party Advisory
https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7e
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210702-0006/
Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/11/05/2%2C
https://www.openwall.com/lists/oss-security/2020/11/20/5%2C
http://www.openwall.com/lists/oss-security/2020/11/05/2
Exploit
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/11/20/5
Exploit
Mailing List
Third Party Advisory
https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7e
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210702-0006/
Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/11/05/2%2C
https://www.openwall.com/lists/oss-security/2020/11/20/5%2C

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия до 4.4.245 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.5 (включая) до 4.9.245 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.10 (включая) до 4.14.208 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.15 (включая) до 4.19.159 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.20 (включая) до 5.4.79 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.5 (включая) до 5.9.10 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Конфигурация 9

Одновременно

cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Конфигурация 10

Одновременно

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Конфигурация 11

Одновременно

cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

EPSS

Процентиль: 34%

0.00138

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2020-25669

CVSS3: 7.8

ubuntu

больше 4 лет назад

A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.

CVE-2020-25669

CVSS3: 4.1

redhat

больше 5 лет назад

A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.

CVE-2020-25669

CVSS3: 7.8

debian

больше 4 лет назад

A vulnerability was found in the Linux Kernel where the function sunkb ...

GHSA-pc2x-7x93-j3gg

CVSS3: 7.8

github

больше 3 лет назад

A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.

BDU:2020-05454

CVSS3: 7.8

fstec

около 5 лет назад

Уязвимость функции sunkbd_reinit() (drivers/input/keyboard/sunkbd.c) ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 34%

0.00138

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-416