CVE-2020-36788
published 2024-05-21CVE-2020-36788: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: avoid a use-after-free when BO init fails nouveau_bo_init() is backed by…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.23%
13.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: avoid a use-after-free when BO init fails
nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code
back to the caller. On failures, ttm_bo_init() invokes the provided
destructor which should de-initialize and free the memory.
Thus, when nouveau_bo_init() returns an error the gem object has already
been released and the memory freed by nouveau_bo_del_ttm().
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.12-1 (bookworm) | linux 5.14.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 < f86e19d918a85492ad1a01fcdc0ad5ecbdac6f96 | f86e19d918a85492ad1a01fcdc0ad5ecbdac6f96 |
| linux | linux | >= 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 < 548f2ff8ea5e0ce767ae3418d1ec5308990be87d | 548f2ff8ea5e0ce767ae3418d1ec5308990be87d |
| linux | linux | >= 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 < bcf34aa5082ee2343574bc3f4d1c126030913e54 | bcf34aa5082ee2343574bc3f4d1c126030913e54 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.84-1 | 5.10.84-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 5.11 < 5.14.12 | 5.14.12 |
| linux | linux_kernel | >= 5.4 < 5.10.73 | 5.10.73 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x52v-qr6m-xx85: In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: avoid a use-after-free when BO init fails
nouveau_bo_init() is back
ghsa_unreviewed·2024-05-21
CVE-2020-36788 [HIGH] CWE-416 GHSA-x52v-qr6m-xx85: In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: avoid a use-after-free when BO init fails
nouveau_bo_init() is back
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: avoid a use-after-free when BO init fails
nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code
back to the caller. On failures, ttm_bo_init() invokes the provided
destructor which should de-initialize and free the memory.
Thus, when nouveau_bo_init() returns an error the gem object has already
been released and the memory freed by nouveau_bo_del_ttm().
OSV
CVE-2020-36788: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: avoid a use-after-free when BO init fails nouveau_bo_init() is backed
osv·2024-05-21·CVSS 7.8
CVE-2020-36788 [HIGH] CVE-2020-36788: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: avoid a use-after-free when BO init fails nouveau_bo_init() is backed
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: avoid a use-after-free when BO init fails nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm_bo_init() invokes the provided destructor which should de-initialize and free the memory. Thus, when nouveau_bo_init() returns an error the gem object has already been released and the memory freed by nouveau_bo_del_ttm().
Red Hat
kernel: drm/nouveau: avoid a use-after-free when BO init fails
vendor_redhat·2024-05-21·CVSS 7.8
CVE-2020-36788 [HIGH] kernel: drm/nouveau: avoid a use-after-free when BO init fails
kernel: drm/nouveau: avoid a use-after-free when BO init fails
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: avoid a use-after-free when BO init fails
nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code
back to the caller. On failures, ttm_bo_init() invokes the provided
destructor which should de-initialize and free the memory.
Thus, when nouveau_bo_init() returns an error the gem object has already
been released and the memory freed by nouveau_bo_del_ttm().
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Ente
Debian
CVE-2020-36788: linux - In the Linux kernel, the following vulnerability has been resolved: drm/nouveau...
vendor_debian·2020·CVSS 7.8
CVE-2020-36788 [HIGH] CVE-2020-36788: linux - In the Linux kernel, the following vulnerability has been resolved: drm/nouveau...
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: avoid a use-after-free when BO init fails nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm_bo_init() invokes the provided destructor which should de-initialize and free the memory. Thus, when nouveau_bo_init() returns an error the gem object has already been released and the memory freed by nouveau_bo_del_ttm().
Scope: local
bookworm: resolved (fixed in 5.14.12-1)
bullseye: resolved (fixed in 5.10.84-1)
forky: resolved (fixed in 5.14.12-1)
sid: resolved (fixed in 5.14.12-1)
trixie: resolved (fixed in 5.14.12-1)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/548f2ff8ea5e0ce767ae3418d1ec5308990be87dhttps://git.kernel.org/stable/c/bcf34aa5082ee2343574bc3f4d1c126030913e54https://git.kernel.org/stable/c/f86e19d918a85492ad1a01fcdc0ad5ecbdac6f96https://git.kernel.org/stable/c/548f2ff8ea5e0ce767ae3418d1ec5308990be87dhttps://git.kernel.org/stable/c/bcf34aa5082ee2343574bc3f4d1c126030913e54https://git.kernel.org/stable/c/f86e19d918a85492ad1a01fcdc0ad5ecbdac6f96
2024-05-21
Published