CVE-2020-36777 : In the Linux kernel, the following vulnerability has been resolved: media: dvbd

In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: Fix memory leak in dvb_media_device_free() dvb_media_device_free() is leaking memory. Free `dvbdev->adapter->conn` before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required."

Published 2024-02-27 19:04:06

Updated 2024-04-10 19:32:09

Source Linux

View at NVD, CVE.org

Products affected by CVE-2020-36777

Linux » Linux Kernel
Versions from including (>=) 4.10.0 and before (<) 4.14.233
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.20.0 and before (<) 5.4.118
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.5.0 and before (<) 4.9.269
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.15.0 and before (<) 4.19.191
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.12.0 and before (<) 5.12.3
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.5.0 and before (<) 5.10.36
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.11.0 and before (<) 5.11.20
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-36777

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 5 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-36777

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	1.8	3.6	NIST	2024-04-10
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2020-36777

CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-36777

https://git.kernel.org/stable/c/32168ca1f123316848fffb85d059860adf3c409f

media: dvbdev: Fix memory leak in dvb_media_device_free() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/cd89f79be5d553c78202f686e8e4caa5fbe94e98

media: dvbdev: Fix memory leak in dvb_media_device_free() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/bf9a40ae8d722f281a2721779595d6df1c33a0bf

media: dvbdev: Fix memory leak in dvb_media_device_free() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/9ad15e214fcd73694ea51967d86055f47b802066

media: dvbdev: Fix memory leak in dvb_media_device_free() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/cede24d13be6c2a62be6d7ceea63c2719b0cfa82

media: dvbdev: Fix memory leak in dvb_media_device_free() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/43263fd43083e412311fa764cd04a727b0c6a749

media: dvbdev: Fix memory leak in dvb_media_device_free() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/9185b3b1c143b8da409c19ac5a785aa18d67a81b

media: dvbdev: Fix memory leak in dvb_media_device_free() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/06854b943e0571ccbd7ad0a529babed1a98ff275

media: dvbdev: Fix memory leak in dvb_media_device_free() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch

Jump to

Vulnerability Details : CVE-2020-36777

Products affected by CVE-2020-36777

Exploit prediction scoring system (EPSS) score for CVE-2020-36777

CVSS scores for CVE-2020-36777

CWE ids for CVE-2020-36777

References for CVE-2020-36777