CVE-2020-0444
published 2020-12-14CVE-2020-0444: In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.21%
11.7th percentile
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.5.13-1 (bookworm) | linux 5.5.13-1 (bookworm) |
| android | — | — | |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5cx5-fcx6-4j7m: In audit_free_lsm_field of auditfilter
ghsa_unreviewed·2022-05-24
CVE-2020-0444 [HIGH] CWE-269 GHSA-5cx5-fcx6-4j7m: In audit_free_lsm_field of auditfilter
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel
OSV
CVE-2020-0444: In audit_free_lsm_field of auditfilter
osv·2020-12-14·CVSS 7.8
CVE-2020-0444 [HIGH] CVE-2020-0444: In audit_free_lsm_field of auditfilter
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel
OSV
CVE-2020-0444: In audit_free_lsm_field of auditfilter
osv·2020-12-01
CVE-2020-0444 CVE-2020-0444: In audit_free_lsm_field of auditfilter
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Red Hat
kernel: bad kfree in auditfilter.c may lead to escalation of privilege
vendor_redhat·2021-01-18·CVSS 7.8
CVE-2020-0444 [HIGH] CWE-1341 kernel: bad kfree in auditfilter.c may lead to escalation of privilege
kernel: bad kfree in auditfilter.c may lead to escalation of privilege
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel
A flaw was found in the Linux kernel. A logic error in audit_data_to_entry can lead to a local escalation of privilege without user interaction needed. A local attacker with special user privilege could crash the system leading to information leak. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Mitigati
Android
CVE-2020-0444: Kernel Audit System
vendor_android·2020-12-01·CVSS 7.8
CVE-2020-0444 [HIGH] CVE-2020-0444: Kernel Audit System
Android Security Bulletin 2020-12-01
CVE: CVE-2020-0444
Severity: HIGH
Type: EoP
Component: Kernel Audit System
References: A-150693166
Upstream kernel
Debian
CVE-2020-0444: linux - In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a...
vendor_debian·2020·CVSS 7.8
CVE-2020-0444 [HIGH] CVE-2020-0444: linux - In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a...
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel
Scope: local
bookworm: resolved (fixed in 5.5.13-1)
bullseye: resolved (fixed in 5.5.13-1)
forky: resolved (fixed in 5.5.13-1)
sid: resolved (fixed in 5.5.13-1)
trixie: resolved (fixed in 5.5.13-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-12-14
Published