PT-2020-3491 · Canonical+1 · Whoopsie+2

Seong-Joong Kim · Published 2020-07-06 · Updated 2020-08-12 · CVE-2020-15570

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Whoopsie versions 0.2.69 and earlier

Description The issue is related to the parse report() function in whoopsie.c, which mishandles memory allocation failures. This can be exploited by an attacker to cause a denial of service via a malformed crash file. The vulnerability is also associated with unlimited resource allocation.

Recommendations For Whoopsie versions 0.2.69 and earlier, as a temporary workaround, consider disabling the parse report() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2020-03816

CVE-2020-15570

USN-4450-1

Affected Products

Linuxmint

Ubuntu

Whoopsie

References · 16

• 🔥 https://github.com/sungjungk/whoopsie_killer2/blob/master/README.md · Exploit
• 🔥 https://github.com/sungjungk/whoopsie_killer2/blob/master/whoopsie_killer2.py · Exploit
• 🔥 https://youtube.com/watch?v=oZXGwC7PWYE · Exploit
• https://bdu.fstec.ru/vul/2020-03816 · Security Note
• https://osv.dev/vulnerability/USN-4450-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15570 · Vendor Advisory
• https://usn.ubuntu.com/4450-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15570 · Security Note
• https://ubuntu.com/security/CVE-2020-12135 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4450-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15570 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11937 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15570 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15570 · Security Note
• https://t.me/cvenotify/4867 · Telegram Post