CVE-2020-36785

In the Linux kernel, the following vulnerability has been resolved:

media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()

The "s3a_buf" is freed along with all the other items on the "asd->s3a_stats" list. It leads to a double free and a use after free.

A use-after-free/double-free flaw in the Linux kernel's Intel atomisp camera driver (staging): atomisp_alloc_css_stat_bufs() can free an s3a statistics buffer that is also freed via the asd->s3a_stats list, leading to a double free and use-after-free. Exploitation requires privileged local access to the atomisp V4L2 device, so Red Hat rates this Low (4.4, denial of service only), below external scores (NIST/CVE.org 7.8). Red Hat Enterprise Linux kernels do not build the atomisp staging driver (CONFIG_VIDEO_ATOMISP is not set), so supported Red Hat products are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.