Integer overflow in GNU C Library (glibc) - CVE-2020-6096

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28193

Integer overflow in GNU C Library (glibc) - CVE-2020-6096

Published: May 24, 2020 / Updated: June 19, 2020


Vulnerability identifier: #VU28193
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6096
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

GNU C Library (glibc)
Gentoo Linux
Ubuntu
Fedora
cflinuxfs3
RecoverPoint for Virtual Machines
Netcool Operations Insight
IBM Cloud Transformation Advisor
libc6 (Ubuntu package)
glibc
sys-libs/glibc

How to mitigate CVE-2020-6096

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

cflinuxfs3 - update to 0.275.0
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
Netcool Operations Insight - update to 1.6.8
libc6 (Ubuntu package) - addressed in versions 2.23-0ubuntu11.3, 2.27-3ubuntu1.5, 2.31-0ubuntu9.7, 2.34-0ubuntu3.2
glibc - addressed in versions 2.30-13.fc31, 2.31-4.fc32, 2.31-5.fc32
sys-libs/glibc - update to 2.32-r5
IBM Cloud Transformation Advisor - update to 3.10.0

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins