Vulnerability CVE-2020-6096: Information
Description
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.
Severity: HIGH (8.1) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| glibc | sisyphus | 2.30-alt3 | 2.38.0.76.e9f05fa1c6-alt1 | ALT-PU-2020-3299-1 | 261804 | Fixed |
| glibc | sisyphus_e2k | 2.35.0.234.3f63f9dfe1-alt1.E2K.27.020.2 | 2.35.0.234.3f63f9dfe1-alt1.E2K.27.020.4 | ALT-PU-2024-1492-1 | - | Fixed |
| glibc | p10 | 2.30-alt3 | 2.32-alt5.p10.3 | ALT-PU-2020-3299-1 | 261804 | Fixed |
| glibc | p9 | 2.27-alt13 | 2.27-alt14 | ALT-PU-2020-3401-1 | 261868 | Fixed |
| glibc | c10f1 | 2.30-alt3 | 2.32-alt5.p10.3 | ALT-PU-2020-3299-1 | 261804 | Fixed |
| glibc | c9f2 | 2.27-alt13 | 2.27-alt14 | ALT-PU-2020-3327-1 | 261895 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://sourceware.org/bugzilla/show_bug.cgi?id=25620 |
|
| https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019 |
|
| GLSA-202101-20 |
|
| [debian-lts-announce] 20221017 [SECURITY] [DLA 3152-1] glibc security update |
|
| FEDORA-2020-d860479b2a | |
| FEDORA-2020-4e92a61688 | |
| [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar |