CVE-2020-15393: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, identified as CVE-2020-15393. The vulnerability was discovered by Kyungtae Kim and disclosed on June 29, 2020. This issue affects the USB testing driver in the Linux kernel (Ubuntu Security, MITRE CVE).

The vulnerability stems from a failure to properly deallocate memory in the usbtest_disconnect function in drivers/usb/misc/usbtest.c. Specifically, dev->buf allocated in usbtest_probe() was not being freed when the device disconnected, leading to a memory leak. The issue has been assigned a CVSS 3 Severity Score of 5.5 (Medium) (Ubuntu Security).

A physically proximate attacker could exploit this vulnerability to cause a denial of service through memory exhaustion (Ubuntu Security).

The vulnerability requires physical access to the system and can be triggered by manipulating USB device connections. The issue has been confirmed to be exploitable in laboratory conditions (LKML Report).

The issue has been fixed by adding kfree(dev->buf) in the usbtest_disconnect function. The fix was committed to the Linux kernel with commit ID 28ebeb8db77035e058a510ce9bd17c2b9a009dba. Various Linux distributions have released patches, including Ubuntu which has fixed it in versions 5.4.0-45.49 for Ubuntu 20.04 LTS, 4.15.0-115.116 for Ubuntu 18.04, and 4.4.0-187.217 for Ubuntu 16.04 LTS (Kernel Commit, Ubuntu Security).