CVE-2020-8428 is a use-after-free vulnerability in the Linux kernel's fs/namei.c component, affecting versions prior to 5.5. This flaw can be triggered by a local attacker, potentially through operations involving UNIX domain sockets being moved and their old parent directories removed. With a CVSS score of 7.1 (High), successful exploitation could lead to a denial of service (kernel OOPS) or the disclosure of sensitive information from kernel memory. Currently, there is no public exploit code available, nor is there evidence of active exploitation or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.19, < 5.5CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2020-8428
Sep 8, 2020kernel: use-after-free in fs/namei.c
Jan 28, 2020fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket if the socket is being moved to a new parent directory and its old parent directory is being removed.
Jan 14, 2020