Buffer overflow in libuv - CVE-2020-8252

Vulnerability identifier: #VU47248

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8252

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to incorrect validation of realpath in libuv. The library incorrectly determines the buffer size, which can result in a buffer overflow if the resolved path is longer than 256 bytes. A remote attacker can pass an overly long path to the application that is using the library, trigger memory corruption and execute arbitrary code on the system.

libuv
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Opensuse
openEuler
Ubuntu
Fedora
MicroSCADA X SYS600
MicroSCADA Pro SYS600
Gateway Station (GWS)
FACTS Control Platform (FCP)
libuv (Alpine package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
nodejs (Alpine package)
rh-nodejs12-nodejs (Red Hat package)
libuv1 (Ubuntu package)
libuv-debuginfo
libuv-devel
libuv
libuv-help
libuv-debugsource
rh-nodejs10-nodejs (Red Hat package)
nodejs (Red Hat package)
nodejs
IBM Cloud Transformation Advisor
Node.js
Adobe Reader

Install update from vendor's website.

libuv - update to 1.39.0
MicroSCADA X SYS600 - update to 10.3
MicroSCADA Pro SYS600 - update to 10.3
libuv (Alpine package) - update to 1.38.1-r0
Node.js - addressed in versions 10.22.1, 12.18.4, 14.9.0
nodejs (Alpine package) - update to 12.18.4-r0
rh-nodejs12-nodejs (Red Hat package) - update to 12.18.4-3.el7
libuv1 (Ubuntu package) - update to 1.34.2-1ubuntu1.1
libuv-debuginfo - update to 1.38.1-2
libuv-devel - update to 1.38.1-2
libuv - update to 1.38.1-2
libuv-help - update to 1.38.1-2
libuv-debugsource - update to 1.38.1-2
rh-nodejs10-nodejs (Red Hat package) - update to 10.23.1-2.el7
nodejs (Red Hat package) - update to 12.18.4-2.module+el8.2.0+8361+192e434e
nodejs - addressed in versions 12.19.0-1.fc31, 14.15.1-1.fc33, 14-3220201203015508.43bbeeef, 14-3320201203015508.601d93de

• https://hackerone.com/reports/965914
• https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/
• https://security.gentoo.org/glsa/202009-15
• https://usn.ubuntu.com/4548-1/

• Gentoo update for libuv
• Buffer overflow in libuv
• Remote code execution in Node.js
• Buffer overflow in nodejs (Alpine package)
• Buffer overflow in libuv (Alpine package)
• OpenSUSE Linux update for nodejs12
• OpenSUSE Linux update for nodejs10
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Software Collections update for rh-nodejs12-nodejs
• Multiple vulnerabilities in Hitachi Energy MicroSCADA Pro/X SYS600
• Multiple vulnerabilities in Hitachi Energy FACTS Control Platform (FCP)
• Multiple vulnerabilities in Hitachi Energy Gateway Station (GWS)
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• openEuler 20.03 LTS update for libuv
• Red Hat Software Collections update for rh-nodejs10-nodejs
• Red Hat Enterprise Linux 8 update for the nodejs:10 module
• Ubuntu update for libuv1
• Fedora 31 update for nodejs
• Fedora 32 Modular update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 33 update for nodejs