CVE-2020-8432: denx u-boot Double Free
Vulnerability summary
CVE-2020-8432 is a high (CVSS 10.0) Double Free vulnerability in denx u-boot. EPSS estimates a 3.06% chance of exploitation in the next 30 days, higher than 87.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 29-01-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.06%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
Decrease -0.54 pp
From 3.60% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- u-boot< 2020.01+dfsg-2
Denx1 product
- u-boot≤ 2020.01
Opensuse1 product
- leapEOL15.2
Ubuntu1 product
- u-boot< 2020.10+dfsg-1ubuntu0~18.04.2 | < 2021.01+dfsg-3ubuntu0~20.04.3
4 vendors · 4 products
References
10 links- www.mail-archive.com/u-boot%40lists.denx.de/msg354060.htmlX Refsource MISC
- www.mail-archive.com/u-boot%40lists.denx.de/msg354114.htmlX Refsource MISC
- lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
