CVE-2020-15436: broadcom brocade_fabric_operating_system_firmware Use After Free

Modified

AliasesUBUNTU-CVE-2020-15436DEBIAN-CVE-2020-15436

Published 23-11-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-15436 is a high (CVSS 7.2) Use After Free vulnerability in broadcom brocade_fabric_operating_system_firmware. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 6.7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.2/10

010

High · v2.0 (NVD)

EPSS score

0.93%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Timeline

23-11-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.16.7v2.07.2

EPSS trend

Probability

0.93%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.93% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (lkml.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu46 products

linuxAll versions (No fix recorded) | < 4.4.0-187.217 | < 4.15.0-115.116 | < 5.4.0-45.49
linux-aws< 4.4.0-1076.80 | < 4.4.0-1112.124 | < 4.15.0-1080.84 | < 5.4.0-1022.22
linux-aws-5.0All versions (No fix recorded)
linux-aws-5.3All versions (No fix recorded)
linux-aws-5.4< 5.4.0-1022.22~18.04.1

linux-aws-fips< 4.15.0-2025.25 | All versions (No fix recorded) | < 5.4.0-1069.73+fips2
linux-aws-hwe< 4.15.0-1080.84~16.04.1
linux-azure< 4.15.0-1093.103~14.04.1 | < 4.15.0-1093.103~16.04.1 | All versions (No fix recorded) | < 5.4.0-1023.23
linux-azure-4.15< 4.15.0-1093.103
linux-azure-5.3All versions (No fix recorded)
linux-azure-5.4< 5.4.0-1023.23~18.04.1
linux-azure-edgeAll versions (No fix recorded)
linux-azure-fdeAll versions (No fix recorded)
linux-azure-fips< 4.15.0-2007.8 | All versions (No fix recorded) | < 5.4.0-1073.76+fips1
linux-fips< 4.4.0-1044.49 | All versions (No fix recorded) | < 4.15.0-1039.44
linux-gcp< 4.15.0-1081.92~16.04.1 | All versions (No fix recorded) | < 5.4.0-1022.22
linux-gcp-4.15< 4.15.0-1081.92
linux-gcp-5.3All versions (No fix recorded)
linux-gcp-5.4< 5.4.0-1022.22~18.04.1
linux-gcp-edgeAll versions (No fix recorded)
linux-gcp-fipsAll versions (No fix recorded) | < 5.4.0-1067.71~20.04.1
linux-gkeAll versions (No fix recorded)
linux-gke-4.15< 4.15.0-1067.70
linux-gke-5.0< 5.0.0-1046.47
linux-gke-5.3< 5.3.0-1033.35
linux-hwe< 4.15.0-115.116~16.04.1 | All versions (No fix recorded)
linux-hwe-5.4< 5.4.0-45.49~18.04.2
linux-hwe-edgeAll versions (No fix recorded)
linux-intel-iot-realtimeAll versions (No fix recorded)
linux-kvm< 4.4.0-1078.85 | < 4.15.0-1072.73 | < 5.4.0-1021.21
linux-lts-xenial< 4.4.0-187.217~14.04.1
linux-oem< 4.15.0-1094.104
linux-oem-5.6< 5.6.0-1048.52
linux-oem-osp1< 5.0.0-1067.72
linux-oracle< 4.15.0-1051.55~16.04.1 | < 4.15.0-1051.55 | < 5.4.0-1022.22
linux-oracle-5.0All versions (No fix recorded)
linux-oracle-5.3All versions (No fix recorded)
linux-oracle-5.4< 5.4.0-1022.22~18.04.1
linux-raspi< 5.4.0-1016.17
linux-raspi-5.4< 5.4.0-1016.17~18.04.1
linux-raspi-realtimeAll versions (No fix recorded)
linux-raspi2< 4.4.0-1137.146 | < 4.15.0-1068.72 | All versions (No fix recorded)
linux-raspi2-5.3< 5.3.0-1032.34
linux-realtimeAll versions (No fix recorded)
linux-riscv< 5.4.0-31.35 | All versions (No fix recorded)
linux-snapdragon< 4.4.0-1141.149 | < 4.15.0-1084.92

Show all 46

Netapp17 products

Show all 17

Broadcom1 product

brocade_fabric_operating_system_firmwarena

Debian1 product

linux< 5.7.6-1

Linux1 product

linux_kernel≥ 2.6.38, < 4.4.229 | ≥ 4.5, < 4.9.229 | ≥ 4.10, < 4.14.186 | ≥ 4.15, < 4.19.130 | ≥ 4.20, < 5.4.49 | ≥ 5.5, < 5.7.6

5 vendors · 66 products

References

8 links

lkml.org/lkml/2020/6/7/379X Refsource MISCREPORTExploitPatchVendor Advisory
security.netapp.com/advisory/ntap-20201218-0002/X Refsource CONFIRMThird Party Advisory
ubuntu.com/security/CVE-2020-15436REPORT
git.kernel.org/linus/2d3a8e2deddea6c89961c422ec0c5b851e648c14REPORT
ubuntu.com/security/notices/USN-4752-1Advisory
www.cve.org/CVERecord?id=CVE-2020-15436REPORT
security-tracker.debian.org/tracker/CVE-2020-15436Advisory
nvd.nist.gov/vuln/detail/CVE-2020-15436OvalAdvisory