An issue was discovered in the Linux kernel before 5.8.2. fs/iouring.c has a use-after-free related to ioasynctaskfunc and ctx reference holding, aka CID-6d816e088c35.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d816e088c359866f9867057e04f244c608c42fe",
"target": {
"file": "fs/io_uring.c",
"function": "io_async_task_func"
},
"digest": {
"function_hash": "222667342065296567129066718026939202376",
"length": 638.0
},
"deprecated": false,
"id": "CVE-2020-36387-005b002a",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d816e088c359866f9867057e04f244c608c42fe",
"target": {
"file": "fs/io_uring.c",
"function": "io_rw_resubmit"
},
"digest": {
"function_hash": "198781334037123373471153192691137678509",
"length": 274.0
},
"deprecated": false,
"id": "CVE-2020-36387-12ea0437",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d816e088c359866f9867057e04f244c608c42fe",
"target": {
"file": "fs/io_uring.c",
"function": "__io_async_wake"
},
"digest": {
"function_hash": "118742466239445669191322613821747638104",
"length": 591.0
},
"deprecated": false,
"id": "CVE-2020-36387-20827278",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d816e088c359866f9867057e04f244c608c42fe",
"target": {
"file": "fs/io_uring.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"312436617722632265558547250171633741697",
"333900346629042888344296994210854237284",
"284315146251266050961537795275319702263",
"124089060835476218760189125248102452772",
"90855569268421082815502494609979158029",
"230931608182659534392371531689543971147",
"258654710214642984751423157162345854806",
"97272457329975285870126523656983894534",
"294243183202273880731493586889046867349",
"4924093532458921195109061287363603088",
"239380978313299997191558590994223803411",
"69875124609150335928989648946338362296",
"323945625237696319595763577005199794719",
"144857621484327072382113849565975450400",
"90317833965351654485596018537615670997",
"49259585588365946804197570878250149626",
"209159556789268681899977287264509867789",
"122852079049966942725729645231414122970",
"158180309432924046737712216551474684094",
"236697252350133583200085790475558321759",
"181815932895378145430488439000427397229",
"36998540353811986369488004447028788080",
"274518783270136917718196002536620098375",
"17163044624274600983890769068418171188",
"248939625800906569935621344443082961976",
"267815701317487953920838616575817921891",
"337391897907205173118052856860959898421",
"164838197610038857534628573175383322438",
"43522759259490670321557824568740975144",
"4267055855748934943021816349428317297",
"57157454928243453822822676708452821575",
"159789350932928375872774301144139179121",
"231047237068896236222987340916655586503",
"114468420117982591214362373139164664863",
"49854298752866899302122453113777817315",
"243478718080014255702772198692766779896",
"64125856450769522898010189349430630125",
"107423402543564582635421756172445583788",
"256532665788480326987839472624900494814",
"237329615133739736127307850101116542583"
]
},
"deprecated": false,
"id": "CVE-2020-36387-2be02fe7",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d816e088c359866f9867057e04f244c608c42fe",
"target": {
"file": "fs/io_uring.c",
"function": "io_req_task_queue"
},
"digest": {
"function_hash": "337453318697630392945522533273070567229",
"length": 369.0
},
"deprecated": false,
"id": "CVE-2020-36387-b2c28009",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d816e088c359866f9867057e04f244c608c42fe",
"target": {
"file": "fs/io_uring.c",
"function": "io_poll_task_func"
},
"digest": {
"function_hash": "307019251099642601213020318713145761730",
"length": 180.0
},
"deprecated": false,
"id": "CVE-2020-36387-bf9ebecd",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d816e088c359866f9867057e04f244c608c42fe",
"target": {
"file": "fs/io_uring.c",
"function": "io_req_task_submit"
},
"digest": {
"function_hash": "180997599958530317328142101977980710100",
"length": 141.0
},
"deprecated": false,
"id": "CVE-2020-36387-d338a338",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d816e088c359866f9867057e04f244c608c42fe",
"target": {
"file": "fs/io_uring.c",
"function": "io_rw_reissue"
},
"digest": {
"function_hash": "56033310385881662322009085944572829293",
"length": 328.0
},
"deprecated": false,
"id": "CVE-2020-36387-d5a21784",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d816e088c359866f9867057e04f244c608c42fe",
"target": {
"file": "fs/io_uring.c",
"function": "io_async_buf_func"
},
"digest": {
"function_hash": "284569565072260256484578848959395239932",
"length": 641.0
},
"deprecated": false,
"id": "CVE-2020-36387-f5929235",
"signature_type": "Function",
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-36387.json"