CVE-2020-15436 Use after free in linux kernel

What is CVE-2020-15436?

CVE-2020-15436 is a medium-severity use after free vulnerability in Linux kernel, published on 23 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.

Weakness: CWE-416

Which versions are affected by CVE-2020-15436?

It affects 19 products.

Products include Broadcom Brocade Fabric Operating System Firmware, Linux kernel, Netapp A250 Firmware, Netapp A700s Firmware, Netapp Aff 500f Firmware, Netapp Aff 8300 Firmware and 13 more.

How do I fix CVE-2020-15436?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2020-15436 being exploited?

There is no known exploitation of CVE-2020-15436 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Linux kernel

• CVE-2023-27534 Path traversal in https://github.com/curl/curl High 8.8
• CVE-2021-4197 Privilege escalation in kernel High 7.8
• CVE-2023-27538 Auth bypass in https://github.com/curl/curl High 7.7
• CVE-2021-27218 Integer overflow in n/a High 7.5
• CVE-2021-27219 Integer overflow in n/a High 7.5

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as A-174737742, ASB-A-174737742, DEBIAN-CVE-2020-15436, GHSA-pcpr-hxm8-3mj4, UBUNTU-CVE-2020-15436.