CVE-2020-16119

What it actually does

Use-after-free in Linux kernel DCCP socket handling where a released dccps_hc_tx_ccid object is reused after a listener socket is freed, allowing memory corruption by a local process.

Why it matters to the business

Local attackers can escalate privileges to root on unpatched Linux systems, potentially leading to full host compromise, data theft, or persistence; the issue affects many distributions but has low observed exploitation probability years after disclosure.

How an attack unfolds

A local attacker creates a DCCP socket, attaches a tx_ccid object, triggers the socket release while still referenced as a listener, then reuses the freed memory to corrupt kernel structures and execute arbitrary code.

How to fix it

Upgrade the Linux kernel to one of the fixed versions listed in the advisory (Ubuntu: 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0-182.191, 3.2.0-149.196 or later equivalent patches from your distribution). Reboot after installation.

How to confirm the fix worked

Verify running kernel version matches or exceeds a fixed release; inspect kernel source or changelog for DCCP socket use-after-free patches; run distribution-specific vulnerability scanners against the installed kernel package.

Typical attack path

1. Obtain local shell access on target system
2. Create and configure a DCCP socket with tx_ccid attachment
3. Force socket release while maintaining listener reference
4. Reuse freed object to corrupt kernel memory
5. Escalate to root privileges and install persistence

How to detect it

Review kernel logs and auditd records for unusual DCCP socket creation or errors around the time of suspected activity; correlate with process execution of network tools; examine memory dumps for signs of kernel object reuse if a compromise is suspected.

What your security team should do

• Patch kernel on all affected systems as soon as feasible despite low EPSS
• Restrict local user accounts and DCCP socket capabilities via seccomp or AppArmor where possible
• Monitor for new kernel releases and schedule maintenance windows
• Audit systems for unnecessary DCCP protocol usage