Description
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Exploits (4)
References (4)
Core 4
Core References
Patch, Vendor Advisory x_refsource_misc
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/12/03/1
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1900933
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210122-0002/
Scores
CVSS v3
7.8
EPSS
0.0662
EPSS Percentile
91.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-416
Status
published
Products (9)
linux/linux_kernel
< 4.4.224
netapp/cloud_backup
netapp/solidfire_baseboard_management_controller
redhat/enterprise_linux
7.0
redhat/enterprise_linux
8.0
redhat/enterprise_mrg
2.0
redhat/openshift_container_platform
4.4
redhat/openshift_container_platform
4.5
redhat/openshift_container_platform
4.6
Published
Dec 11, 2020
Tracked Since
Feb 18, 2026