high
7.2
CWE
416
Advisory Published
Updated

CVE-2020-12464: Use After Free

First published: Wed Apr 29 2020(Updated: )

A use-after-free flaw was found in usb_sg_cancel in drivers/usb/core/message.c in USB core subsystem. This flaw could allow a local attacker with special user privilege (or root) to crash the system due to a race problem in scatter-gather cancellation and transfer completion in usb_sg_wait. This vulnerability can even lead to a kernel information leak problem . Here usb_sg_cancel() does not take any reference to the transfer and there is nothing to prevent the URBs from being deallocated while the routine is trying to use them. Taking a reference by incrementing the transfer's io-&gt;count field while the cancellation is in progress and decrementing it afterwards can be way to address this. The transfer's URBs are not deallocated until io-&gt;complete is triggered, which happens when io-&gt;count reaches zero. ~~~ BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] BUG: KASAN: use-after-free in usb_hcd_unlink_urb+0x5f/0x170 drivers/usb/core/hcd.c:1607 Read of size 4 at addr ffff888065379610 by task kworker/u4:1/27 ~~~ References: <a href="https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8">https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8</a> <a href="https://lkml.org/lkml/2020/3/23/52">https://lkml.org/lkml/2020/3/23/52</a> Upstream commit: <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=056ad39ee9253873522f6469c3364964a322912b">https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=056ad39ee9253873522f6469c3364964a322912b</a>

Credit: cve@mitre.org cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Linux Kernel<3.16.85
Linux Kernel>=3.17<4.4.221
Linux Kernel>=4.5<4.9.221
Linux Kernel>=4.10<4.14.178
Linux Kernel>=4.15<4.19.119
Linux Kernel>=4.20<5.4.36
Linux Kernel>=5.5<5.6.8
NetApp Active IQ Unified Manager for VMware vSphere
netapp cloud backup
netapp hci baseboard management controller=h300s
netapp hci baseboard management controller=h410c
netapp hci baseboard management controller=h410s
netapp hci baseboard management controller=h500s
netapp hci baseboard management controller=h610c
netapp hci baseboard management controller=h610s
netapp hci baseboard management controller=h615c
netapp hci baseboard management controller=h700s
NetApp HCI Storage Nodes
netapp solidfire \& hci storage node
NetApp SteelStore
NetApp AFF A700s Firmware
netapp hci compute node
netapp solidfire baseboard management controller
debian/linux
5.10.223-1
5.10.226-1
6.1.123-1
6.1.128-1
6.12.12-1
6.12.15-1
Android

Remedy

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=056ad39ee9253873522f6469c3364964a322912b

Remedy

https://github.com/torvalds/linux/commit/056ad39ee9253873522f6469c3364964a322912b

Remedy

https://patchwork.kernel.org/patch/11463781/

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2020-12464?

    CVE-2020-12464 is classified as a high-severity vulnerability due to its potential to cause system crashes.

  • How do I fix CVE-2020-12464?

    To fix CVE-2020-12464, it is recommended to upgrade to patched versions of the Linux kernel or the specific software affected.

  • What software is affected by CVE-2020-12464?

    CVE-2020-12464 affects multiple versions of the Linux kernel and certain NetApp products such as Active IQ Unified Manager and cloud backup solutions.

  • What type of attack does CVE-2020-12464 facilitate?

    CVE-2020-12464 enables a local attacker with special user privileges to exploit a use-after-free flaw in the USB core subsystem.

  • How can I determine if my system is vulnerable to CVE-2020-12464?

    You can check the version of your Linux kernel or affected software to determine if it falls within the vulnerable ranges specified for CVE-2020-12464.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203