PT-2020-6548 · Unknown+1 · F2Fs-Tools+1

Published 2020-08-27 · Updated 2024-10-18 · CVE-2020-6107

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F2fs-Tools F2fs.Fsck version 1.13

Description An exploitable information disclosure issue exists in the dev read functionality. A specially crafted f2fs filesystem can cause an uninitialized read, resulting in information disclosure. An attacker can trigger this issue by providing a malicious file.

Recommendations For F2fs-Tools F2fs.Fsck version 1.13, consider disabling the dev read functionality as a temporary workaround until a patch is available. Restrict access to the f2fs filesystem to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Out of bounds Read

Improper Check for Exceptional Conditions

Information Disclosure

Weakness Enumeration

CWE-125

CWE-754

CWE-200

CWE-253

Related Identifiers

ALT-PU-2020-2693

ALT-PU-2024-13883

BDU:2021-06201

CVE-2020-6107

Affected Products

Alt Linux

F2Fs-Tools

References · 16

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1049 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-6107 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2020-6107 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6107 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06201 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-6107 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-6107 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-6107 · Vendor Advisory
• https://security.gentoo.org/glsa/202101-26 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6107 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-6107 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020101506 · Note
• https://security.alpinelinux.org/vuln/CVE-2020-6107 · Note
• https://t.me/cibsecurity/15294 · Telegram Post
• https://redos.red-soft.ru/updatesec · Note