CVE-2020-6096

Katalog CVE

CVSS 8.1 · High EPSS 5,4%

Kerentanan Signed to Unsigned Conversion Error pada gnu glibc, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

Rincian

Terbit di NVD

1 April 2020

Terakhir diubah

14 Oktober 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-195: Signed to Unsigned Conversion Error
CWE-191: Integer Underflow (Wrap or Wraparound)
CWE-681: Incorrect Conversion between Numeric Types

EPSS (30 hari)

5,4% peluang dieksploitasi; lebih tinggi dari 92,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202101-20 advisory pihak ketiga
• https://sourceware.org/bugzilla/show_bug.cgi?id=25620 issue tracking · advisory pihak ketiga
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019 advisory pihak ketiga
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.a...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYXTDOOB4PQG...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URXOIA2LDUKHQ...
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html