CVE-2020-12464: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-12464 was discovered in the Linux kernel before version 5.6.8, specifically in the usb_sg_cancel function in drivers/usb/core/message.c. The vulnerability involves a use-after-free condition that occurs because a transfer takes place without a proper reference (NVD, Ubuntu).

The vulnerability occurs when cancellation of the S-G (scatter-gather) transfer races with transfer completion. In this scenario, usb_sg_cancel() may continue to access the transfer's URBs after usb_sg_wait() has freed them. This happens because usb_sg_cancel() does not take any sort of reference to the transfer, allowing URBs to be deallocated while the routine is trying to use them (Kernel Commit).

A physically proximate attacker could potentially exploit this vulnerability to cause a denial of service (system crash or memory corruption) or possibly execute arbitrary code (Ubuntu, Debian).

The vulnerability was discovered by FuzzUSB (a variant of syzkaller) and demonstrated through a proof-of-concept that triggered a KASAN use-after-free detection in the kernel. While the exact exploitation method is not fully clear, it requires physical access to the target system (LKML).

The vulnerability was fixed in Linux kernel version 5.6.8 by modifying usb_sg_cancel() to take a reference by incrementing the transfer's io->count field while cancellation is in progress and decrementing it afterward. The transfer's URBs are not deallocated until io->complete is triggered, which happens when io->count reaches zero (Kernel Commit).