Unscored CVE-2020-36387 EUVD-2020-23918GHSA-h865-4c46-jfqg

An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx referenc…

Published Jun 7, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: linux Package: linux-aws-5.0 Package: linux-aws-5.3 Package: linux-azure Package: linux-azure-5.3 Package: linux-azure-edge Package: linux-gcp Package: linux-gcp-5.3 Package: linux-gcp-edge Package: linux-gke-4.15 Package: linux-hwe Package: linux-hwe-edge Package: linux-oem Package: linux-oem-5.6 Package: linux-oracle-5.0 Package: linux-oracle-5.3 Package: linux-raspi2 Package: linux-riscv Ecosystem: Debian Ecosystem: Ubuntu

Description

An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	linux	5.7.17-1	—
Debian 13	linux	5.7.17-1	—
Debian 12	linux	5.7.17-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	linux-riscv +2	No fix yet	—
Ubuntu 18.04 LTS	linux-gcp +13	No fix yet	—
Ubuntu 16.04 LTS	linux-hwe-edge	No fix yet	—

References