CVE-2020-12464: Use After Free

Published Apr 29, 2020
·
Updated

A use-after-free flaw was found in usbsgcancel in drivers/usb/core/message.c in USB core subsystem. This flaw could allow a local attacker with special user privilege (or root) to crash the system due to a race problem in scatter-gather cancellation and transfer completion in usbsgwait. This vulnerability can even lead to a kernel information leak problem .

Here usbsgcancel() does not take any reference to the transfer and there is nothing to prevent the URBs from being deallocated while the routine is trying to use them.

Taking a reference by incrementing the transfer's io->count field while the cancellation is in progress and decrementing it afterwards can be way to address this. The transfer's URBs are not deallocated until io->complete is triggered, which happens when io->count reaches zero. ~~~ BUG: KASAN: use-after-free in atomicread include/asm-generic/atomic-instrumented.h:26 [inline] BUG: KASAN: use-after-free in usbhcdunlinkurb+0x5f/0x170 drivers/usb/core/hcd.c:1607 Read of size 4 at addr ffff888065379610 by task kworker/u4:1/27 ~~~

References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8 https://lkml.org/lkml/2020/3/23/52

Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=056ad39ee9253873522f6469c3364964a322912b

Other sources

In usbsgcancel of message.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

— OSV

usbsgcancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.

— Ubuntu

Affected Software

92 affected componentsFixes available
Linux Linux kernel<3.16.85
Linux Linux kernel>=3.17<4.4.221
Linux Linux kernel>=4.5<4.9.221
Linux Linux kernel>=4.10<4.14.178
Linux Linux kernel>=4.15<4.19.119
Linux Linux kernel>=4.20<5.4.36
Linux Linux kernel>=5.5<5.6.8
NetApp Active Iq Unified Manager Vmware Vsphere
NetApp Cloud Backup
NetApp Hci Baseboard Management Controller=h300s
NetApp Hci Baseboard Management Controller=h410c
NetApp Hci Baseboard Management Controller=h410s
NetApp Hci Baseboard Management Controller=h500s
NetApp Hci Baseboard Management Controller=h610c
NetApp Hci Baseboard Management Controller=h610s
NetApp Hci Baseboard Management Controller=h615c
NetApp Hci Baseboard Management Controller=h700s
NetApp Hci Storage Nodes
NetApp Solidfire \& Hci Storage Node
NetApp Steelstore Cloud Integrated Storage
NetApp AFF A700s
NetApp Hci Compute Node
NetApp Solidfire Baseboard Management Controller
Google Android
debian/linux
6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.3-1
android/:linux_kernel:>=:0<:2020-08-05
:2020-08-05
ubuntu/linux-aws<4.4.0-1073.77
4.4.0-1073.77
ubuntu/linux-azure<4.15.0-1089.99~14.04.1
4.15.0-1089.99~14.04.1
ubuntu/linux-lts-xenial<4.4.0-184.214~14.04.1
4.4.0-184.214~14.04.1
ubuntu/linux*
ubuntu/linux<4.4.0-184.214
4.4.0-184.214
ubuntu/linux-aws<4.4.0-1109.120
4.4.0-1109.120
ubuntu/linux-aws-hwe<4.15.0-1073.77~16.04.1
4.15.0-1073.77~16.04.1
ubuntu/linux-azure<4.15.0-1089.99~16.04.1
4.15.0-1089.99~16.04.1
ubuntu/linux-gcp<4.15.0-1077.87~16.04.1
4.15.0-1077.87~16.04.1
ubuntu/linux-hwe<4.15.0-106.107~16.04.1
4.15.0-106.107~16.04.1
ubuntu/linux-kvm<4.4.0-1075.82
4.4.0-1075.82
ubuntu/linux-oracle<4.15.0-1045.49~16.04.1
4.15.0-1045.49~16.04.1
ubuntu/linux-raspi2<4.4.0-1134.143
4.4.0-1134.143
ubuntu/linux-snapdragon<4.4.0-1138.146
4.4.0-1138.146
ubuntu/linux-hwe-edge*
ubuntu/linux-fips<4.4.0-1041.46
4.4.0-1041.46
ubuntu/linux-fips*
ubuntu/linux<4.15.0-106.107
4.15.0-106.107
ubuntu/linux-aws<4.15.0-1073.77
4.15.0-1073.77
ubuntu/linux-aws-5.3<5.3.0-1023.25~18.04.1
5.3.0-1023.25~18.04.1
ubuntu/linux-azure-4.15<4.15.0-1089.99
4.15.0-1089.99
ubuntu/linux-azure-5.3<5.3.0-1028.29~18.04.1
5.3.0-1028.29~18.04.1
ubuntu/linux-gcp-4.15<4.15.0-1077.87
4.15.0-1077.87
ubuntu/linux-gcp-5.3<5.3.0-1026.28~18.04.1
5.3.0-1026.28~18.04.1
ubuntu/linux-gke-4.15<4.15.0-1063.66
4.15.0-1063.66
ubuntu/linux-gke-5.0<5.0.0-1042.43
5.0.0-1042.43
ubuntu/linux-gke-5.3<5.3.0-1026.28~18.04.1
5.3.0-1026.28~18.04.1
ubuntu/linux-hwe<5.3.0-59.53~18.04.1
5.3.0-59.53~18.04.1
ubuntu/linux-kvm<4.15.0-1067.68
4.15.0-1067.68
ubuntu/linux-oem<4.15.0-1087.97
4.15.0-1087.97
ubuntu/linux-oem-osp1<5.0.0-1059.64
5.0.0-1059.64
ubuntu/linux-oracle<4.15.0-1045.49
4.15.0-1045.49
ubuntu/linux-oracle-5.3<5.3.0-1024.26~18.04.1
5.3.0-1024.26~18.04.1
ubuntu/linux-raspi2<4.15.0-1063.67
4.15.0-1063.67
ubuntu/linux-raspi2-5.3<5.3.0-1027.29~18.04.1
5.3.0-1027.29~18.04.1
ubuntu/linux-snapdragon<4.15.0-1080.87
4.15.0-1080.87
ubuntu/linux-aws-5.0*
ubuntu/linux-azure*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-edge*
ubuntu/linux-hwe-edge*
ubuntu/linux-oracle-5.0*
ubuntu/linux-aws-fips<4.15.0-2018.18
4.15.0-2018.18
ubuntu/linux-azure-fips<4.15.0-2006.7
4.15.0-2006.7
ubuntu/linux-fips<4.15.0-1034.39
4.15.0-1034.39
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-37.41
5.4.0-37.41
ubuntu/linux-aws<5.4.0-1015.15
5.4.0-1015.15
ubuntu/linux-azure<5.4.0-1016.16
5.4.0-1016.16
ubuntu/linux-gcp<5.4.0-1015.15
5.4.0-1015.15
ubuntu/linux-kvm<5.4.0-1015.15
5.4.0-1015.15
ubuntu/linux-oem-5.6<5.6.0-1010.10
5.6.0-1010.10
ubuntu/linux-oracle<5.4.0-1015.15
5.4.0-1015.15
ubuntu/linux-raspi<5.4.0-1012.12
5.4.0-1012.12
ubuntu/linux-riscv<5.4.0-27.31
5.4.0-27.31
ubuntu/linux-azure-fde*
ubuntu/linux-gke*
ubuntu/linux-raspi2*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1073.77
  2. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1089.99~14.04.1
  3. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-184.214~14.04.1
  4. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-184.214
  5. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1109.120
  6. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1073.77~16.04.1
  7. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1089.99~16.04.1
  8. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1077.87~16.04.1
  9. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-106.107~16.04.1
  10. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1075.82
  11. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1045.49~16.04.1
  12. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.4.0-1134.143
  13. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.4.0-1138.146
  14. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1041.46
  15. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-106.107
  16. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1073.77
  17. Upgrade

    Upgrade ubuntu/linux-aws-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1023.25~18.04.1
  18. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1089.99
  19. Upgrade

    Upgrade ubuntu/linux-azure-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1028.29~18.04.1
  20. Upgrade

    Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1077.87
  21. Upgrade

    Upgrade ubuntu/linux-gcp-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1026.28~18.04.1
  22. Upgrade

    Upgrade ubuntu/linux-gke-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1063.66
  23. Upgrade

    Upgrade ubuntu/linux-gke-5.0 to a version that resolves this vulnerability.

    Fixed in 5.0.0-1042.43
  24. Upgrade

    Upgrade ubuntu/linux-gke-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1026.28~18.04.1
  25. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 5.3.0-59.53~18.04.1
  26. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1067.68
  27. Upgrade

    Upgrade ubuntu/linux-oem to a version that resolves this vulnerability.

    Fixed in 4.15.0-1087.97
  28. Upgrade

    Upgrade ubuntu/linux-oem-osp1 to a version that resolves this vulnerability.

    Fixed in 5.0.0-1059.64
  29. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1045.49
  30. Upgrade

    Upgrade ubuntu/linux-oracle-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1024.26~18.04.1
  31. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1063.67
  32. Upgrade

    Upgrade ubuntu/linux-raspi2-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1027.29~18.04.1
  33. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.15.0-1080.87
  34. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2018.18
  35. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2006.7
  36. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1034.39
  37. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-37.41
  38. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1015.15
  39. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1016.16
  40. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1015.15
  41. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1015.15
  42. Upgrade

    Upgrade ubuntu/linux-oem-5.6 to a version that resolves this vulnerability.

    Fixed in 5.6.0-1010.10
  43. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1015.15
  44. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1012.12
  45. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 5.4.0-27.31
  46. Upgrade

    Upgrade android/:linux_kernel: to a version that resolves this vulnerability.

    Fixed in :2020-08-05
  47. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1

Event History

Apr 29, 2020
CVE Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·05:59 PM
Data Sourced
via MITRE·05:59 PM
Description
Data Sourced
via OSV·06:15 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
May 5, 2020
Data Sourced
via Red Hat·02:25 PM
DescriptionSeverityAffected Software
Aug 1, 2020
Advisory Published
via OSV·12:00 AM
Aug 3, 2020
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2020-12464?

CVE-2020-12464 is classified as a high-severity vulnerability due to its potential to cause system crashes.

2

How do I fix CVE-2020-12464?

To fix CVE-2020-12464, it is recommended to upgrade to patched versions of the Linux kernel or the specific software affected.

3

What software is affected by CVE-2020-12464?

CVE-2020-12464 affects multiple versions of the Linux kernel and certain NetApp products such as Active IQ Unified Manager and cloud backup solutions.

4

What type of attack does CVE-2020-12464 facilitate?

CVE-2020-12464 enables a local attacker with special user privileges to exploit a use-after-free flaw in the USB core subsystem.

5

How can I determine if my system is vulnerable to CVE-2020-12464?

You can check the version of your Linux kernel or affected software to determine if it falls within the vulnerable ranges specified for CVE-2020-12464.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203