PT-2020-5869 · Linux+5 · Linux Kernel+5
Butt3Rflyh4Ck
·
Published
2020-05-07
·
Updated
2025-09-29
·
CVE-2020-27786
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.7-rc6
Description
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Recommendations
For Linux kernel versions prior to 5.7-rc6, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to midi devices to minimize the risk of exploitation. Avoid using the
ioctl command on midi devices until the issue is resolved.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linux Kernel
Red Hat
Suse