Infinite loop in musl libc - CVE-2020-28928

Vulnerability identifier: #VU48579

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28928

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the wcsnrtombs() function in musl libc. A remote attacker can consume all available system resources and cause denial of service conditions.

musl libc
Arch Linux
Ubuntu
Fedora
IBM Security Verify Bridge
Dell EMC Data Protection Search
Juniper Cloud Native Router
Open Enclave SDK
musl (Alpine package)
musl (Ubuntu package)
musl-dev (Ubuntu package)
musl
Oracle GraalVM Enterprise Edition
Solutions Enabler Virtual Appliance
Solutions Enabler
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax
Dell EMC PowerProtect Data Protection
Junos cRPD

Install update from vendor's website.

musl libc - update to 1.2.2
Open Enclave SDK - update to 0.15.0
musl (Alpine package) - update to 1.2.2_pre2-r0
musl (Ubuntu package) - update to Ubuntu Pro
musl-dev (Ubuntu package) - update to Ubuntu Pro
musl - addressed in versions 1.2.2-1.fc33, 1.2.2-1.fc34
Solutions Enabler - addressed in versions 9.1.0.17, 9.2.2.0
Solutions Enabler Virtual Appliance - addressed in versions 9.1.0.17, 9.2.2.0
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.28, 9.2.2.2
Unisphere for PowerMax - addressed in versions 9.1.0.28, 9.2.2.2
Dell EMC Data Protection Search - update to 19.5.1
Dell EMC PowerProtect Data Protection - update to 19.5.1
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• http://seclists.org/oss-sec/2020/q4/152
• https://musl.libc.org/releases.html

• Denial of service in musl libc
• Infinite loop in musl (Alpine package)
• Arch Linux update for musl
• Open Enclave SDK update for musl libc
• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Multiple vulnerabilities in IBM Security Verify Bridge
• Multiple vulnerabilities in Dell EMC Data Protection Search and Dell EMC PowerProtect Data Protection
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler
• Ubuntu update for musl
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Fedora 33 update for musl
• Fedora 34 update for musl