critical9.8
CVE-2020-8432
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function.
Impact
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Denx | U-Boot | through 2020.01 |
| Opensuse | Leap | Version 15.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.html
- https://www.mail-archive.com/u-boot%40lists.denx.de/msg354060.html
- https://www.mail-archive.com/u-boot%40lists.denx.de/msg354114.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.html
- https://www.mail-archive.com/u-boot%40lists.denx.de/msg354060.html
- https://www.mail-archive.com/u-boot%40lists.denx.de/msg354114.html