CVE-2020-8428

What it actually does

Use-after-free in fs/namei.c triggered by UNIX domain socket open operations during directory move and removal, resulting in kernel OOPS or memory disclosure.

Why it matters to the business

Local attackers on unpatched Linux systems can crash the kernel causing denial of service or leak sensitive kernel memory, disrupting operations on servers and endpoints until fixed.

How an attack unfolds

An attacker with local access issues an open syscall against a UNIX domain socket, relocates the socket to a new parent directory, and deletes the original parent to trigger the use-after-free condition in namei handling.

How to fix it

Upgrade Linux kernel to a version containing commit d0cb50185ae942b03c4327be322055d622dc79f6 (kernel 5.5 or later) across all affected distributions.

How to confirm the fix worked

Confirm kernel version is at least 5.5; inspect source for commit d0cb50185ae942b03c4327be322055d622dc79f6 in fs/namei.c; test socket and directory operations post-upgrade for stability.

Typical attack path

1. Obtain local access on target Linux system
2. Create or reference a UNIX domain socket
3. Perform open syscall on the socket
4. Move socket to new parent directory
5. Remove original parent directory
6. Trigger use-after-free resulting in OOPS or memory leak

How to detect it

Review kernel logs and dmesg for OOPS/panic entries referencing namei or socket directory operations; audit process activity involving UNIX sockets and directory renames/removals by non-root users.

What your security team should do

• Prioritize kernel upgrades to 5.5+ on all Linux hosts
• Apply patches immediately on internet-facing or multi-user systems
• Monitor kernel logs for namei-related OOPS entries
• Limit untrusted local user accounts until patched