CVE-2020-8432

2020-01-2919:15:14

Google

osv.dev

7.3 High

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

82.2%

JSON

In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis.

CPENameOperatorVersion
u-booteqU-Boot-0_4_0
u-booteq2017.03-rc2
u-booteq2017.11-rc4
u-booteq2018.01-rc3
u-booteq2016.05-rc1
u-booteq2014.07
u-booteq2015.01
u-booteq2009.01-rc2
u-booteqLABEL_2003_04_15_1900
u-booteqLABEL_2003_06_29_0145

Name	Operator	Version
u-boot	eq	U-Boot-0_4_0
u-boot	eq	2017.03-rc2
u-boot	eq	2017.11-rc4
u-boot	eq	2018.01-rc3
u-boot	eq	2016.05-rc1
u-boot	eq	2014.07
u-boot	eq	2015.01
u-boot	eq	2009.01-rc2
u-boot	eq	LABEL_2003_04_15_1900
u-boot	eq	LABEL_2003_06_29_0145