CVE-2020-36783: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-36783 is a vulnerability in the Linux kernel's I2C subsystem, specifically in the IMG SCB (Serial Control Bus) driver. The vulnerability was discovered in December 2020 and publicly disclosed on February 28, 2024. The issue affects Linux kernel versions from 4.15 through 5.12.4, impacting the power management reference counting mechanism (NVD).

The vulnerability stems from a reference leak in the power management (PM) functionality of the IMG SCB I2C driver. The issue occurs when pm_runtime_get_sync fails in the img_i2c_xfer and img_i2c_init functions, where the PM reference count is incorrectly incremented even on failure. This leads to a reference leak due to missing putting operations. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a reference leak in the system's power management subsystem, potentially affecting system stability and resource management. The primary impact is on system availability, as indicated by the CVSS scoring which shows high availability impact but no confidentiality or integrity impacts (NVD).

The vulnerability requires local access with low privileges to exploit. The attack complexity is low, but user interaction is not required for exploitation. The vulnerability can be triggered through the I2C subsystem's power management functions (NVD).

The issue has been fixed by replacing pm_runtime_get_sync with pm_runtime_resume_and_get to maintain proper usage counter balance. The fix was implemented in multiple kernel versions through various patches. Ubuntu has released fixes for affected versions, including version 5.4.0-77.86 for focal (20.04 LTS) (Ubuntu).