PT-2020-6550 · Unknown+1 · F2Fs-Tools+1
Lilith >_>
·
Published
2020-08-27
·
Updated
2024-10-18
·
CVE-2020-6104
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
F2fs-Tools F2fs.Fsck version 1.13
Description
An exploitable information disclosure issue exists in the get dnode of data functionality. A specially crafted f2fs filesystem can cause information disclosure. An attacker can provide a malicious file to trigger this issue, potentially allowing access to confidential information through a buffer overflow error, which is essentially a memory access violation that occurs when the program tries to access a memory location outside the boundaries of the buffer, leading to unauthorized data disclosure.
Recommendations
For F2fs-Tools F2fs.Fsck version 1.13, consider restricting access to the get dnode of data functionality until a patch is available. As a temporary workaround, avoid using specially crafted f2fs filesystems that could trigger the information disclosure issue. At the moment, there is no information about a newer version that contains a fix for this issue.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
F2Fs-Tools