A vulnerability was found in the Linux Kernel where the function sunkbdreinit having been scheduled by sunkbdinterrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbddisconnect, there is still an alias in sunkbdreinit causing Use After Free.
[
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.245"
}
]
},
{
"events": [
{
"introduced": "4.5"
},
{
"fixed": "4.9.245"
}
]
},
{
"events": [
{
"introduced": "4.10"
},
{
"fixed": "4.14.208"
}
]
},
{
"events": [
{
"introduced": "4.15"
},
{
"fixed": "4.19.159"
}
]
},
{
"events": [
{
"introduced": "4.20"
},
{
"fixed": "5.4.79"
}
]
},
{
"events": [
{
"introduced": "5.5"
},
{
"fixed": "5.9.10"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0"
}
]
}
]
[
{
"signature_version": "v1",
"target": {
"function": "sunkbd_reinit",
"file": "drivers/input/keyboard/sunkbd.c"
},
"digest": {
"length": 699.0,
"function_hash": "104334658876116112984850968431497711748"
},
"source": "https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7e",
"signature_type": "Function",
"id": "CVE-2020-25669-2ef9f874",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"function": "sunkbd_interrupt",
"file": "drivers/input/keyboard/sunkbd.c"
},
"digest": {
"length": 894.0,
"function_hash": "6367602438856320083335949813575234265"
},
"source": "https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7e",
"signature_type": "Function",
"id": "CVE-2020-25669-5d3987c8",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"file": "drivers/input/keyboard/sunkbd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"118443532649537729941164673811931340163",
"203422894197475587745740242930361167592",
"164083477563821247878985626832757806476",
"61999899458629429136124360853706058765",
"63279945143989848315624696910852363939",
"123018636941730572960266198395926658616",
"183507149842197368945927851632256745067",
"111131185691292227801151521408911123159",
"187111365880764740442279416957264087128",
"154382406990812131599216740163784003465",
"153675118561862691926914250467307895224",
"162160927677496898538112843028620145315",
"49941134006353884664399353715228690198",
"291793303316683833641795005995016011429",
"68167436149283934921765433719294647516",
"264558019207172767982267730792785594691",
"26233430185146513213152028039451186732",
"54125615799416165011841180645235597537",
"318579792029624966781450794205982525009"
]
},
"source": "https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7e",
"signature_type": "Line",
"id": "CVE-2020-25669-62ee3537",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"function": "sunkbd_enable",
"file": "drivers/input/keyboard/sunkbd.c"
},
"digest": {
"length": 144.0,
"function_hash": "90205578429393617714537585819780989492"
},
"source": "https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7e",
"signature_type": "Function",
"id": "CVE-2020-25669-7cd22648",
"deprecated": false
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-25669.json"