CVE-2020-27786
Last modified
CVE-2020-27786 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. EPSS estimates a 1.66% chance of exploitation in the next 30 days.
Description
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | < 4.4.224 |
| Linux | Linux Kernel | >= 4.5, < 4.9.224 |
| Linux | Linux Kernel | >= 4.10, < 4.14.181 |
| Linux | Linux Kernel | >= 4.15, < 4.19.124 |
| Linux | Linux Kernel | >= 4.20, < 5.4.42 |
| Linux | Linux Kernel | >= 5.5, < 5.6.14 |
| Redhat | Openshift Container Platform | 4.4 |
| Redhat | Openshift Container Platform | 4.5 |
| Redhat | Openshift Container Platform | 4.6 |
| Redhat | Enterprise Linux | 7.0 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Mrg | 2.0 |
| Netapp | Cloud Backup | All versions |
| Netapp | Solidfire Baseboard Management Controller | All versions |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1900933Issue Tracking, Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210122-0002/Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1900933Issue Tracking, Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210122-0002/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-27786?
How severe is CVE-2020-27786?
How do I fix CVE-2020-27786?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-27780A flaw was found in Linux-Pam in versions prior to 1.5.1 in …9.8
- CVE-2020-27781User credentials can be manipulated and stolen by Native Cep…7.1
- CVE-2020-27782A flaw was found in the Undertow AJP connector. Malicious re…7.5
- CVE-2020-27783A XSS vulnerability was discovered in python-lxml's clean mo…6.1
- CVE-2020-27784A vulnerability was found in the Linux kernel, where accessi…5.5
- CVE-2020-27785Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-27787A Segmentaation fault was found in UPX in invert_pt_dynamic(…5.5
- CVE-2020-27788An out-of-bounds read access vulnerability was discovered in…5.5
- CVE-2020-27789Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-2779Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
- CVE-2020-27790A floating point exception issue was discovered in UPX in Pa…5.5
- CVE-2020-27791Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2020-27786?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST