Use-after-free in Linux kernel - CVE-2020-27786

Vulnerability identifier: #VU83583

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-27786

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local authenticated user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the MIDI implementation in Linux kernel. A local authenticated user can trigger a use-after-free error and escalate privileges on the system.

Linux kernel
SUSE OpenStack Cloud
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Live Patching
SUSE Linux Enterprise Module for Live Patching
openEuler
kgraft-patch-4_4_121-92_149-default
kgraft-patch-4_12_14-122_60-default
kgraft-patch-4_4_180-94_138-default
kgraft-patch-4_4_180-94_138-default-debuginfo
kgraft-patch-4_12_14-95_65-default
kgraft-patch-4_4_121-92_146-default
kernel-livepatch-4_12_14-150_63-default-debuginfo
kernel-livepatch-4_12_14-150_63-default
kgraft-patch-4_4_180-94_135-default
kgraft-patch-4_4_180-94_135-default-debuginfo
kernel
bpftool
kernel-debugsource
kernel-tools
kernel-debuginfo
perf-debuginfo
python3-perf-debuginfo
perf
python2-perf
python3-perf
bpftool-debuginfo
kernel-tools-devel
kernel-devel
kernel-tools-debuginfo
python2-perf-debuginfo
kernel-source
kernel-livepatch-4_12_14-150_58-default-debuginfo
kernel-livepatch-4_12_14-150_58-default
kgraft-patch-4_4_180-94_130-default
kgraft-patch-4_4_180-94_130-default-debuginfo
kgraft-patch-4_12_14-95_60-default
kgraft-patch-4_4_121-92_141-default
kgraft-patch-4_4_180-94_127-default
kgraft-patch-4_4_121-92_138-default
kgraft-patch-4_12_14-95_54-default
kgraft-patch-4_12_14-95_57-default
kernel-livepatch-4_12_14-150_52-default
kernel-livepatch-4_12_14-150_52-default-debuginfo
kernel-livepatch-4_12_14-150_55-default
kernel-livepatch-4_12_14-150_55-default-debuginfo
kgraft-patch-4_4_121-92_135-default
kgraft-patch-4_4_180-94_121-default
kgraft-patch-4_4_180-94_121-default-debuginfo
kgraft-patch-4_4_180-94_124-default
kgraft-patch-4_4_180-94_124-default-debuginfo
kgraft-patch-4_4_180-94_127-default-debuginfo
kgraft-patch-4_4_180-94_116-default
kgraft-patch-4_4_180-94_116-default-debuginfo
kgraft-patch-4_12_14-95_51-default
kgraft-patch-4_4_121-92_129-default
kgraft-patch-4_12_14-95_48-default

Install update from vendor's website.

kgraft-patch-4_4_121-92_149-default - update to 2-2.2
kgraft-patch-4_12_14-122_60-default - update to 2-2.2
kgraft-patch-4_4_180-94_138-default - update to 2-2.2
kgraft-patch-4_4_180-94_138-default-debuginfo - update to 2-2.2
kgraft-patch-4_12_14-95_65-default - update to 3-2.2
kgraft-patch-4_4_121-92_146-default - update to 4-2.2
kernel-livepatch-4_12_14-150_63-default-debuginfo - update to 4-2.2
kernel-livepatch-4_12_14-150_63-default - update to 4-2.2
kgraft-patch-4_4_180-94_135-default - update to 4-2.2
kgraft-patch-4_4_180-94_135-default-debuginfo - update to 4-2.2
kernel - update to 4.19.90-2102.2.0.0057
bpftool - update to 4.19.90-2102.2.0.0057
kernel-debugsource - update to 4.19.90-2102.2.0.0057
kernel-tools - update to 4.19.90-2102.2.0.0057
kernel-debuginfo - update to 4.19.90-2102.2.0.0057
perf-debuginfo - update to 4.19.90-2102.2.0.0057
python3-perf-debuginfo - update to 4.19.90-2102.2.0.0057
perf - update to 4.19.90-2102.2.0.0057
python2-perf - update to 4.19.90-2102.2.0.0057
python3-perf - update to 4.19.90-2102.2.0.0057
bpftool-debuginfo - update to 4.19.90-2102.2.0.0057
kernel-tools-devel - update to 4.19.90-2102.2.0.0057
kernel-devel - update to 4.19.90-2102.2.0.0057
kernel-tools-debuginfo - update to 4.19.90-2102.2.0.0057
python2-perf-debuginfo - update to 4.19.90-2102.2.0.0057
kernel-source - update to 4.19.90-2102.2.0.0057
kernel-livepatch-4_12_14-150_58-default-debuginfo - update to 6-2.2
kernel-livepatch-4_12_14-150_58-default - update to 6-2.2
kgraft-patch-4_4_180-94_130-default - update to 6-2.2
kgraft-patch-4_4_180-94_130-default-debuginfo - update to 6-2.2
kgraft-patch-4_12_14-95_60-default - update to 6-2.2
kgraft-patch-4_4_121-92_141-default - update to 6-2.2
kgraft-patch-4_4_180-94_127-default - update to 7-2.2
kgraft-patch-4_4_121-92_138-default - update to 7-2.2
kgraft-patch-4_12_14-95_54-default - update to 7-2.2
kgraft-patch-4_12_14-95_57-default - update to 7-2.2
kernel-livepatch-4_12_14-150_52-default - update to 7-2.2
kernel-livepatch-4_12_14-150_52-default-debuginfo - update to 7-2.2
kernel-livepatch-4_12_14-150_55-default - update to 7-2.2
kernel-livepatch-4_12_14-150_55-default-debuginfo - update to 7-2.2
kgraft-patch-4_4_121-92_135-default - update to 7-2.2
kgraft-patch-4_4_180-94_121-default - update to 7-2.2
kgraft-patch-4_4_180-94_121-default-debuginfo - update to 7-2.2
kgraft-patch-4_4_180-94_124-default - update to 7-2.2
kgraft-patch-4_4_180-94_124-default-debuginfo - update to 7-2.2
kgraft-patch-4_4_180-94_127-default-debuginfo - update to 7-2.2
kgraft-patch-4_4_180-94_116-default - update to 8-2.2
kgraft-patch-4_4_180-94_116-default-debuginfo - update to 8-2.2
kgraft-patch-4_12_14-95_51-default - update to 9-2.2
kgraft-patch-4_4_121-92_129-default - update to 9-2.2
kgraft-patch-4_12_14-95_48-default - update to 10-2.2

• Exploit #9789 - CVE-2020-27786-Kernel-Exploit (4.9 Kernel Exploit for CVE-2020-27786) (May 13, 2024)
• Exploit #9736 - CVE-2020-27786 () (April 19, 2024)

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d
• https://bugzilla.redhat.com/show_bug.cgi?id=1900933
• https://security.netapp.com/advisory/ntap-20210122-0002/
• http://www.openwall.com/lists/oss-security/2020/12/03/1

• Privilege escalation in Linux kernel MIDI
• SUSE update for the Linux Kernel (Live Patch 15 for SLE 12 SP5)
• SUSE update for the Linux Kernel (Live Patch 16 for SLE 12 SP4)
• SUSE update for the Linux Kernel (Live Patch 13 for SLE 12 SP4)
• SUSE update for the Linux Kernel (Live Patch 39 for SLE 12 SP2)
• SUSE update for the Linux Kernel (Live Patch 18 for SLE 15)
• SUSE update for the Linux Kernel (Live Patch 36 for SLE 12 SP2)
• openEuler 20.03 LTS SP1 update for kernel