PT-2020-20053 · Buffer List+2 · Bl+2

Chalker · Published 2020-08-30 · Updated 2022-11-14 · CVE-2020-8244

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions bl versions prior to 4.0.3 bl versions prior to 3.0.1 bl versions prior to 2.2.1 bl versions prior to 1.2.3

Description A buffer over-read issue exists that could allow an attacker to supply user input that corrupts the BufferList state, potentially exposing uninitialized memory via regular slice() calls. This occurs when the consume() argument becomes negative.

Recommendations For versions prior to 4.0.3, update to version 4.0.3 or later to resolve the issue. For versions prior to 3.0.1, update to version 3.0.1 or later to resolve the issue. For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue.

Exploit

Fix

Buffer Over-read

Out of bounds Read

Weakness Enumeration

CWE-126

CWE-125

Related Identifiers

ALT-PU-2021-2408

ALT-PU-2022-3069

CVE-2020-8244

DLA-2698-1

GHSA-PP7H-53GX-MX7R

USN-5098-1

USN-5159-1

Affected Products

Alt Linux

Ubuntu

Bl

References · 18

• 🔥 https://hackerone.com/reports/966347 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8244 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8244 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5098-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5159-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pp7h-53gx-mx7r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8244 · Security Note
• https://ubuntu.com/security/CVE-2020-8244 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8244 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5098-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-8244 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5159-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-8244 · Security Note
• https://osv.dev/vulnerability/DLA-2698-1 · Vendor Advisory
• https://github.com/rvagg/bl/commit/8a8c13c880e2bef519133ea43e0e9b78b5d0c91e · Note