Review reviewHigh

CVE-2020-36785

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() The "s3a_buf" is freed along with all the other items on the "asd->s3a_stats" list. It leads to a double free and a use after free.

CVSS: 7.8
EPSS: 0.22%
CISA KEV: Not listed
Published: 2024.02.28

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.22%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= a49d25364dfb9f8a64037488a39ab1f56c5fa419 < 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654, >= ad85094b293e40e7a2f831b0311a389d952ebd5e < d218c7a0284f6b92a7b82d2e19706e18663b4193, >= ad85094b293e40e7a2f831b0311a389d952ebd5e < 801c1d505894008c888bc71d08d5cff5d87f8aba, >= ad85094b293e40e7a2f831b0311a389d952ebd5e < 8267ccd7b9df7ab682043507dd682fe0621cf045, >= ad85094b293e40e7a2f831b0311a389d952ebd5e < ba11bbf303fafb33989e95473e409f6ab412b18d, >= 4.12, >= 5.8, >= 5.8 < 5.10.37, >= 5.11 < 5.11.21, >= 5.12 < 5.12.4
Fixed versions: 5.10.37, 5.11.21, 5.12.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-415, CWE-416