CVE-2020-8432

CRITICAL

Das U-Boot <2020.01 - Code Injection

Title source: llm

Description

In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis.

Scores

CVSS v3 9.8
EPSS 0.0196
EPSS Percentile 83.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-415 CWE-787
Status published

Affected Products (2)

denx/u-boot < 2020.01
opensuse/leap

Timeline

Published Jan 29, 2020
Tracked Since Feb 18, 2026