CVE-2020-12464: Use After Free

First published: Wed Apr 29 2020(Updated: )

A use-after-free flaw was found in usb_sg_cancel in drivers/usb/core/message.c in USB core subsystem. This flaw could allow a local attacker with special user privilege (or root) to crash the system due to a race problem in scatter-gather cancellation and transfer completion in usb_sg_wait. This vulnerability can even lead to a kernel information leak problem . Here usb_sg_cancel() does not take any reference to the transfer and there is nothing to prevent the URBs from being deallocated while the routine is trying to use them. Taking a reference by incrementing the transfer's io-&gt;count field while the cancellation is in progress and decrementing it afterwards can be way to address this. The transfer's URBs are not deallocated until io-&gt;complete is triggered, which happens when io-&gt;count reaches zero. ~~~ BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] BUG: KASAN: use-after-free in usb_hcd_unlink_urb+0x5f/0x170 drivers/usb/core/hcd.c:1607 Read of size 4 at addr ffff888065379610 by task kworker/u4:1/27 ~~~ References: <a href="https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8">https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8</a> <a href="https://lkml.org/lkml/2020/3/23/52">https://lkml.org/lkml/2020/3/23/52</a> Upstream commit: <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=056ad39ee9253873522f6469c3364964a322912b">https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=056ad39ee9253873522f6469c3364964a322912b</a>

Credit: cve@mitre.org cve@mitre.org cve@mitre.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/launchpad-cve
• source/Launchpad
• agent/type
• agent/author
• agent/severity
• agent/weakness
• collector/nvd-api
• agent/software-canonical-lookup-request
• collector/nvd-index
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2020-12464
• collector/android-source
• source/Android
• agent/software-canonical-lookup
• collector/mitre-cve
• source/MITRE
• agent/remedy
• agent/references
• agent/first-publish-date
• agent/tags
• collector/usn-cve
• source/Ubuntu
• agent/description
• agent/event
• collector/nvd-cve
• source/NVD
• agent/last-modified-date
• collector/security-tracker-debian
• source/Debian
• agent/softwarecombine
• agent/trending
• vendor/linux
• canonical/linux linux kernel
• version/linux linux kernel/3.17
• version/linux linux kernel/4.5
• version/linux linux kernel/4.10
• version/linux linux kernel/4.15
• version/linux linux kernel/4.20
• version/linux linux kernel/5.5
• vendor/netapp
• canonical/netapp active iq unified manager vmware vsphere
• canonical/netapp cloud backup
• canonical/netapp hci baseboard management controller
• version/netapp hci baseboard management controller/h300s
• version/netapp hci baseboard management controller/h410c
• version/netapp hci baseboard management controller/h410s
• version/netapp hci baseboard management controller/h500s
• version/netapp hci baseboard management controller/h610c
• version/netapp hci baseboard management controller/h610s
• version/netapp hci baseboard management controller/h615c
• version/netapp hci baseboard management controller/h700s
• canonical/netapp hci storage nodes
• canonical/netapp solidfire \& hci storage node
• canonical/netapp steelstore cloud integrated storage
• canonical/netapp aff a700s
• canonical/netapp hci compute node
• canonical/netapp solidfire baseboard management controller
• vendor/google
• canonical/google android
• package-manager/debian