Lucene search

Ubuntu.comUB:CVE-2020-0433

HistorySep 17, 2020 - 12:00 a.m.

CVE-2020-0433

2020-09-1700:00:00

ubuntu.com

cve-2020-0433

improper locking

privilege escalation

android kernel

stable backports

android advisory

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

In blk_mq_queue_tag_busy_iter of blk-mq-tag.c, there is a possible use
after free due to improper locking. This could lead to local escalation of
privilege with no additional execution privileges needed. User interaction
is not needed for exploitation.Product: AndroidVersions: Android
kernelAndroid ID: A-151939299

Notes

Author	Note
sbeattie	see android advisory for stable backports

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-101.102UNKNOWN
ubuntu16.04noarchlinux< 4.4.0-185.215UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1067.71UNKNOWN
ubuntu16.04noarchlinux-aws< 4.4.0-1110.121UNKNOWN
ubuntu16.04noarchlinux-aws-hwe< 4.15.0-1067.71~16.04.1UNKNOWN
ubuntu16.04noarchlinux-azure< 4.15.0-1083.93~16.04.1UNKNOWN
ubuntu18.04noarchlinux-azure-4.15< 4.15.0-1083.93UNKNOWN
ubuntu16.04noarchlinux-gcp< 4.15.0-1071.81~16.04.1UNKNOWN
ubuntu18.04noarchlinux-gke-4.15< 4.15.0-1059.62UNKNOWN
ubuntu18.04noarchlinux-hwe< 5.0.0-23.24~18.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< 4.15.0-101.102	UNKNOWN
ubuntu	16.04	noarch	linux	< 4.4.0-185.215	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< 4.15.0-1067.71	UNKNOWN
ubuntu	16.04	noarch	linux-aws	< 4.4.0-1110.121	UNKNOWN
ubuntu	16.04	noarch	linux-aws-hwe	< 4.15.0-1067.71~16.04.1	UNKNOWN
ubuntu	16.04	noarch	linux-azure	< 4.15.0-1083.93~16.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-azure-4.15	< 4.15.0-1083.93	UNKNOWN
ubuntu	16.04	noarch	linux-gcp	< 4.15.0-1071.81~16.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-gke-4.15	< 4.15.0-1059.62	UNKNOWN
ubuntu	18.04	noarch	linux-hwe	< 5.0.0-23.24~18.04.1	UNKNOWN

Rows per page:

1-10 of 201

References

git.kernel.org/linus/530ca2c9bd6949c72c9b5cfc330cb3dbccaa3f5b

git.kernel.org/linus/f5bbbbe4d63577026f908a809f22f5fd5a90ea1f

launchpad.net/bugs/cve/CVE-2020-0433

nvd.nist.gov/vuln/detail/CVE-2020-0433

security-tracker.debian.org/tracker/CVE-2020-0433

source.android.com/security/bulletin/pixel/2020-09-01

www.cve.org/CVERecord?id=CVE-2020-0433

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for UB:CVE-2020-0433