CVE-2020-36785 (GCVE-0-2020-36785)

Vulnerability from cvelistv5 – Published: 2024-02-28 08:13 – Updated: 2026-08-26 11:00
VLAI
Title
media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()
Summary
In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() The "s3a_buf" is freed along with all the other items on the "asd->s3a_stats" list. It leads to a double free and a use after free.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 19:00 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a49d25364dfb9f8a64037488a39ab1f56c5fa419 , < 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654 (git)
Affected: ad85094b293e40e7a2f831b0311a389d952ebd5e , < d218c7a0284f6b92a7b82d2e19706e18663b4193 (git)
Affected: ad85094b293e40e7a2f831b0311a389d952ebd5e , < 801c1d505894008c888bc71d08d5cff5d87f8aba (git)
Affected: ad85094b293e40e7a2f831b0311a389d952ebd5e , < 8267ccd7b9df7ab682043507dd682fe0621cf045 (git)
Affected: ad85094b293e40e7a2f831b0311a389d952ebd5e , < ba11bbf303fafb33989e95473e409f6ab412b18d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Affected: 5.8
Unaffected: 0 , < 4.12 (semver)
Unaffected: 4.18 , < 5.8 (semver)
Unaffected: 5.10.37 , ≤ 5.10.* (semver)
Unaffected: 5.11.21 , ≤ 5.11.* (semver)
Unaffected: 5.12.4 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:37:07.332Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d218c7a0284f6b92a7b82d2e19706e18663b4193"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/801c1d505894008c888bc71d08d5cff5d87f8aba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8267ccd7b9df7ab682043507dd682fe0621cf045"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ba11bbf303fafb33989e95473e409f6ab412b18d"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-36785",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-08T19:00:20.730320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-08T19:00:31.766Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/atomisp/pci/atomisp_ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654",
              "status": "affected",
              "version": "a49d25364dfb9f8a64037488a39ab1f56c5fa419",
              "versionType": "git"
            },
            {
              "lessThan": "d218c7a0284f6b92a7b82d2e19706e18663b4193",
              "status": "affected",
              "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
              "versionType": "git"
            },
            {
              "lessThan": "801c1d505894008c888bc71d08d5cff5d87f8aba",
              "status": "affected",
              "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
              "versionType": "git"
            },
            {
              "lessThan": "8267ccd7b9df7ab682043507dd682fe0621cf045",
              "status": "affected",
              "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
              "versionType": "git"
            },
            {
              "lessThan": "ba11bbf303fafb33989e95473e409f6ab412b18d",
              "status": "affected",
              "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/atomisp/pci/atomisp_ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "4.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.18",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.37",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.21",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.4",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()\n\nThe \"s3a_buf\" is freed along with all the other items on the\n\"asd-\u003es3a_stats\" list.  It leads to a double free and a use after free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening the AtomISP V4L2 `/dev/video*` node and issuing local ioctls (VIDIOC_REQBUFS / format setup) that call atomisp_alloc_css_stat_bufs(); it is not reachable via network or adjacent-protocol packets.\nAC:L - An attacker who can open the device can enable both S3A and DIS grids through normal camera configuration and force the dis_buf kzalloc failure (e.g., memory exhaustion), reliably hitting the deterministic double-free error path.\nPR:L - atomisp_open and the VIDIOC_REQBUFS path perform no CAP_SYS_ADMIN/root checks; access only needs an unprivileged local user with video-group or camera-permission access to the device node.\nUI:N - The attacker opens the device and issues the ioctls themselves; no separate victim interaction is required.\nS:U - Impact is kernel memory corruption within the host kernel privilege boundary (local privilege escalation/DoS), not a VM, IOMMU, or other cross-authority escape.\nC:H - Double-free/use-after-free of the list-linked s3a_buf enables heap reuse and arbitrary kernel memory reads once the freed object is reclaimed.\nI:H - The UAF/double-free allows heap spraying and corruption of freed kernel objects, enabling arbitrary write or control-flow hijacking primitives.\nA:H - The double-free/UAF reliably causes kernel oops, panic, or hang even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T11:00:34.375Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"
        },
        {
          "url": "https://git.kernel.org/stable/c/d218c7a0284f6b92a7b82d2e19706e18663b4193"
        },
        {
          "url": "https://git.kernel.org/stable/c/801c1d505894008c888bc71d08d5cff5d87f8aba"
        },
        {
          "url": "https://git.kernel.org/stable/c/8267ccd7b9df7ab682043507dd682fe0621cf045"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba11bbf303fafb33989e95473e409f6ab412b18d"
        }
      ],
      "title": "media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2020-36785",
    "datePublished": "2024-02-28T08:13:06.032Z",
    "dateReserved": "2024-02-26T17:07:27.435Z",
    "dateUpdated": "2026-08-26T11:00:34.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-36785",
      "date": "2026-09-28",
      "epss": "0.00226",
      "percentile": "0.12007"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CD2F1C00-3D81-452B-AE61-0B2C1A536A1D",
                  "versionEndExcluding": "5.10.37",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8CBB94EC-EC33-4464-99C5-03E5542715F0",
                  "versionEndExcluding": "5.11.21",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D8C7052F-1B7B-4327-9C2B-84EBF3243838",
                  "versionEndExcluding": "5.12.4",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()\n\nThe \"s3a_buf\" is freed along with all the other items on the\n\"asd-\u003es3a_stats\" list.  It leads to a double free and a use after free."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: medios: atomisp: Corrige el use after free en atomisp_alloc_css_stat_bufs() El \"s3a_buf\" se libera junto con todos los dem\u00e1s elementos de la lista \"asd-\u0026gt;s3a_stats\". Conduce a una doble gratuidad y un use after free."
        }
      ],
      "id": "CVE-2020-36785",
      "lastModified": "2024-12-06T15:59:06.807",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-02-28T09:15:36.930",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/801c1d505894008c888bc71d08d5cff5d87f8aba"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8267ccd7b9df7ab682043507dd682fe0621cf045"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/ba11bbf303fafb33989e95473e409f6ab412b18d"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d218c7a0284f6b92a7b82d2e19706e18663b4193"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/801c1d505894008c888bc71d08d5cff5d87f8aba"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8267ccd7b9df7ab682043507dd682fe0621cf045"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/ba11bbf303fafb33989e95473e409f6ab412b18d"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d218c7a0284f6b92a7b82d2e19706e18663b4193"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-415"
            },
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/media/atomisp/pci/atomisp_ioctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654",
                    "status": "affected",
                    "version": "a49d25364dfb9f8a64037488a39ab1f56c5fa419",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d218c7a0284f6b92a7b82d2e19706e18663b4193",
                    "status": "affected",
                    "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "801c1d505894008c888bc71d08d5cff5d87f8aba",
                    "status": "affected",
                    "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8267ccd7b9df7ab682043507dd682fe0621cf045",
                    "status": "affected",
                    "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba11bbf303fafb33989e95473e409f6ab412b18d",
                    "status": "affected",
                    "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/media/atomisp/pci/atomisp_ioctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.12"
                  },
                  {
                    "status": "affected",
                    "version": "5.8"
                  },
                  {
                    "lessThan": "4.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "unaffected",
                    "version": "4.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.37",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.11.*",
                    "status": "unaffected",
                    "version": "5.11.21",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CD2F1C00-3D81-452B-AE61-0B2C1A536A1D",
                    "versionEndExcluding": "5.10.37",
                    "versionStartIncluding": "5.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8CBB94EC-EC33-4464-99C5-03E5542715F0",
                    "versionEndExcluding": "5.11.21",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D8C7052F-1B7B-4327-9C2B-84EBF3243838",
                    "versionEndExcluding": "5.12.4",
                    "versionStartIncluding": "5.12",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()\n\nThe \"s3a_buf\" is freed along with all the other items on the\n\"asd-\u003es3a_stats\" list.  It leads to a double free and a use after free."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: medios: atomisp: Corrige el use after free en atomisp_alloc_css_stat_bufs() El \"s3a_buf\" se libera junto con todos los dem\u00e1s elementos de la lista \"asd-\u0026gt;s3a_stats\". Conduce a una doble gratuidad y un use after free."
          }
        ],
        "id": "CVE-2020-36785",
        "lastModified": "2026-08-26T11:16:36.860",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2020-36785",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-08T19:00:20.730320Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-28T09:15:36.930",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/801c1d505894008c888bc71d08d5cff5d87f8aba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8267ccd7b9df7ab682043507dd682fe0621cf045"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ba11bbf303fafb33989e95473e409f6ab412b18d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d218c7a0284f6b92a7b82d2e19706e18663b4193"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/801c1d505894008c888bc71d08d5cff5d87f8aba"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8267ccd7b9df7ab682043507dd682fe0621cf045"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ba11bbf303fafb33989e95473e409f6ab412b18d"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d218c7a0284f6b92a7b82d2e19706e18663b4193"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              },
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-28T06:39:55+00:00",
      "cve": "CVE-2020-36785",
      "id": "CVE-2020-36785",
      "initial_release_date": "2020-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-36785.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:50:24Z",
      "cve": "CVE-2020-36785",
      "id": "CVE-2020-36785",
      "initial_release_date": "2024-02-29T04:07:09Z",
      "product_status:known_not_affected": "321",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2020-36785",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2020-36785.json",
      "version": "20"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T17:37:07.332Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d218c7a0284f6b92a7b82d2e19706e18663b4193"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/801c1d505894008c888bc71d08d5cff5d87f8aba"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8267ccd7b9df7ab682043507dd682fe0621cf045"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ba11bbf303fafb33989e95473e409f6ab412b18d"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2020-36785",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-08-08T19:00:20.730320Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-08T19:00:27.176Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/staging/media/atomisp/pci/atomisp_ioctl.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654",
                  "status": "affected",
                  "version": "a49d25364dfb9f8a64037488a39ab1f56c5fa419",
                  "versionType": "git"
                },
                {
                  "lessThan": "d218c7a0284f6b92a7b82d2e19706e18663b4193",
                  "status": "affected",
                  "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
                  "versionType": "git"
                },
                {
                  "lessThan": "801c1d505894008c888bc71d08d5cff5d87f8aba",
                  "status": "affected",
                  "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
                  "versionType": "git"
                },
                {
                  "lessThan": "8267ccd7b9df7ab682043507dd682fe0621cf045",
                  "status": "affected",
                  "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
                  "versionType": "git"
                },
                {
                  "lessThan": "ba11bbf303fafb33989e95473e409f6ab412b18d",
                  "status": "affected",
                  "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/staging/media/atomisp/pci/atomisp_ioctl.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.12"
                },
                {
                  "status": "affected",
                  "version": "5.8"
                },
                {
                  "lessThan": "4.12",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.8",
                  "status": "unaffected",
                  "version": "4.18",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.37",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.11.*",
                  "status": "unaffected",
                  "version": "5.11.21",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.18",
                      "versionStartIncluding": "4.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.37",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.11.21",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.4",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()\n\nThe \"s3a_buf\" is freed along with all the other items on the\n\"asd-\u003es3a_stats\" list.  It leads to a double free and a use after free."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - Exploitation requires opening the AtomISP V4L2 `/dev/video*` node and issuing local ioctls (VIDIOC_REQBUFS / format setup) that call atomisp_alloc_css_stat_bufs(); it is not reachable via network or adjacent-protocol packets.\nAC:L - An attacker who can open the device can enable both S3A and DIS grids through normal camera configuration and force the dis_buf kzalloc failure (e.g., memory exhaustion), reliably hitting the deterministic double-free error path.\nPR:L - atomisp_open and the VIDIOC_REQBUFS path perform no CAP_SYS_ADMIN/root checks; access only needs an unprivileged local user with video-group or camera-permission access to the device node.\nUI:N - The attacker opens the device and issues the ioctls themselves; no separate victim interaction is required.\nS:U - Impact is kernel memory corruption within the host kernel privilege boundary (local privilege escalation/DoS), not a VM, IOMMU, or other cross-authority escape.\nC:H - Double-free/use-after-free of the list-linked s3a_buf enables heap reuse and arbitrary kernel memory reads once the freed object is reclaimed.\nI:H - The UAF/double-free allows heap spraying and corruption of freed kernel objects, enabling arbitrary write or control-flow hijacking primitives.\nA:H - The double-free/UAF reliably causes kernel oops, panic, or hang even without full exploitation."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-26T11:00:34.375Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"
            },
            {
              "url": "https://git.kernel.org/stable/c/d218c7a0284f6b92a7b82d2e19706e18663b4193"
            },
            {
              "url": "https://git.kernel.org/stable/c/801c1d505894008c888bc71d08d5cff5d87f8aba"
            },
            {
              "url": "https://git.kernel.org/stable/c/8267ccd7b9df7ab682043507dd682fe0621cf045"
            },
            {
              "url": "https://git.kernel.org/stable/c/ba11bbf303fafb33989e95473e409f6ab412b18d"
            }
          ],
          "title": "media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2020-36785",
        "datePublished": "2024-02-28T08:13:06.032Z",
        "dateReserved": "2024-02-26T17:07:27.435Z",
        "dateUpdated": "2026-08-26T11:00:34.375Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.