CVE-2020-6070

An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a logic flaw and out-of-bounds heap operations, resulting in code execution. An attacker can provide a malicious file to trigger this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
f2fs-tools_projectf2fs-tools
1.12.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
f2fs-tools
bookworm
1.15.0-1
fixed
bullseye
1.14.0-2
fixed
buster
no-dsa
sid
1.16.0-1.1
fixed
stretch
no-dsa
trixie
1.16.0-1.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
f2fs-tools
bionic
needed
focal
needed
groovy
ignored
hirsute
ignored
impish
ignored
jammy
needed
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needed
oracular
ignored
plucky
ignored
questing
ignored
resolute
needed
trusty
dne
xenial
needed
Common Weakness Enumeration
References
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SZ4HMQKNI35NBWJI6XMJBGWPEKZRR72/
https://talosintelligence.com/vulnerability_reports/TALOS-2020-0988
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SZ4HMQKNI35NBWJI6XMJBGWPEKZRR72/
https://talosintelligence.com/vulnerability_reports/TALOS-2020-0988