High severity · published Dec 11, 2020
CVE-2020-27786
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a…
7.8
CVSS
1.7%
EPSS
No
On KEV
Description
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
before 4.4.224; 4.5 before 4.9.224; 4.10 before 4.14.181; 4.15 before 4.19.124; 4.20 before 5.4.42; 5.5 before 5.6.14 · source: NVD
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
EL
Enterprise Linux · Redhat
7.0; 8.0 · source: NVD
EM
Enterprise Mrg · Redhat
2.0 · source: NVD
OC
Openshift Container Platform · Redhat
4.4; 4.5; 4.6 · source: NVD
SB
Solidfire Baseboard Management Controller · Netapp
All versions, or not specified · source: NVD