CVE-2020-27786
High
Description
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Linux Kernel
PublishedDec 11, 2020
First seenDec 11, 2020
Weakness typeCWE-416Use after free
How to fix
Update
- linux linux_kernel4.4.224, 4.9.224, 4.14.181, 4.19.124, 5.4.42, 5.6.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | v < 4.4.224, 4.5 ≤ v < 4.9.224, 4.10 ≤ v < 4.14.181, 4.15 ≤ v < 4.19.124, 4.20 ≤ v < 5.4.42, 5.5 ≤ v < 5.6.14 | 4.4.224, 4.9.224, 4.14.181, 4.19.124, 5.4.42, 5.6.14 |
| redhat openshift_container_platform | 4.4, 4.5, 4.6 | — |
| redhat enterprise_linux | 7.0, 8.0 | — |
| redhat enterprise_mrg | 2.0 | — |
| netapp cloud_backup | No range specified | — |
| netapp solidfire_baseboard_management_controller | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.