CVE-2020-8432 - CVE House
Back to Database
Status published Critical CVE-2020-8432

In Das U-Boot through 2020.01, a double free has been...

Vulnerability Description

In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-8432

Credits & Attribution

No credits recorded in the NVD database.

References

More from denx

View All →
CVE-2024-57259
sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error...
High 7.1
CVE-2024-57258
Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1...
High 7.1
CVE-2024-57257
A stack consumption issue in sqfs_size in Das U-Boot before...
Low 2
CVE-2024-57256
An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1...
High 7.1
CVE-2024-57255
An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1...
High 7.1

Affected Vendor

Affected Software

u-boot, leap
Vulnerable Versions:
0, 15.2

Timeline

Official Publish: January 29th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.