net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Net-snmp | Net-snmp | * | 5.8 (including) |
| Red Hat Enterprise Linux 8 | RedHat | net-snmp-1:5.8-12.el8_1.1 | * |
| Red Hat Enterprise Linux 8 | RedHat | net-snmp-1:5.8-12.el8_1.1 | * |
| Net-snmp | Ubuntu | devel | * |
| Net-snmp | Ubuntu | focal | * |
| Net-snmp | Ubuntu | trusty | * |