CVE-2020-8432 Use after free in n/a

Critical 9.8 Published 29 Jan 2020 Updated 4 Aug 2024

A double free vulnerability in U-Boot allows attackers to execute arbitrary code via a write-what-where condition.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-8432?

CVE-2020-8432 is a critical use after free vulnerability in Opensuse Leap, published on 29 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis.

Weakness: CWE-787, CWE-415

Which versions are affected by CVE-2020-8432?

It affects 2 products.

Products include Denx U-Boot, Opensuse Leap.

How do I fix CVE-2020-8432?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2020-8432 being exploited?

There is no known exploitation of CVE-2020-8432 in the wild and no public exploit code.

All Opensuse Leap vulnerabilities

Sources

Also known as DEBIAN-CVE-2020-8432, GHSA-j5r3-pwr2-9cqj, UBUNTU-CVE-2020-8432.