CVE-2020-14381 — Use After Free in Kernel

CWE-416 — Use After Free13 documents10 sources
Severity
7.8HIGHNVD
EPSS
0.6%
top 29.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Linux KernelDebian LinuxGoogle Android+1 more
Timeline
PublishedDec 3
Latest updateSep 24

Description

A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶debiandebian/linux< linux 5.5.13-1 (bookworm)
▶NVDlinux/linux_kernel< 5.6+1
▶Debianlinux/linux_kernel< 5.5.13-1+3
▶CVEListV5linux/linux_kernelLinux kernel 5.6-rc6

Patches

Patch: bugzilla.redhat.com ↗Patch: git.kernel.org ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-69w4-9w32-v3qh: A flaw was found in the Linux kernel’s futex implementation↗2022-05-24
▶
OSV
CVE-2020-14381: In futex_setup_timer and related functions of futex↗2021-08-01
▶
OSV
CVE-2020-14381: A flaw was found in the Linux kernel’s futex implementation↗2020-12-03
▶

📋Vendor Advisories

5
CISA ICS
Siemens SIMATIC↗2024-03-14
▶
Android
CVE-2020-14381: Futex↗2021-08-01
▶
Microsoft
A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about↗2020-12-08
▶
Red Hat
kernel: referencing inode of removed superblock in get_futex_key() causes UAF↗2020-05-07
▶
Debian
CVE-2020-14381: linux - A flaw was found in the Linux kernel’s futex implementation. This flaw allows a ...↗2020
▶

📄Research Papers

2
arXiv
KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities↗2024-09-24
▶
arXiv
Timeloops: Automatic System Call Policy Learning for Containerized Microservices↗2022-09-26
▶

💬Community

2
Bugzilla
CVE-2020-14381 kernel: referencing inode of removed superblock in get_futex_key() causes UAF. [fedora-all]↗2020-09-01
▶
Bugzilla
CVE-2020-14381 kernel: referencing inode of removed superblock in get_futex_key() causes UAF↗2020-09-01
▶