Memory Corruption Vulnerability in bsdiff Package: CVE-2020-14315
Summary
UBUNTU-CVE-2020-14315: A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Affects bsdiff versions 4.3-15 – 4.3-15+deb8u1build0.16.04.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bsdiff is a tool used for creating and applying binary patches. It is widely utilized in software distribution to efficiently update applications by only transmitting the differences between the old and new versions. The bsdiff package is known for its efficiency in handling binary files, but it has been found to have a significant vulnerability that could be exploited by attackers.
Vulnerability Detail
A memory corruption vulnerability exists in the bspatch component of bsdiff version 4.3. This issue arises from insufficient checks when handling external inputs, which allows an attacker to bypass the sanity checks and write outside the boundaries of a dynamically allocated buffer. This could lead to arbitrary code execution, data corruption, or crashes, significantly impacting the integrity and security of the affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of the bsdiff tool by restricting its access to untrusted inputs or by using alternative patching tools until the package is updated.
Conclusion
The memory corruption vulnerability in the bsdiff package, identified as CVE-2020-14315, poses significant risks to system security. It is crucial for users to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bsdiff →
FAQ
CVE-2020-14315 is a memory corruption vulnerability found in the bsdiff tool, which can lead to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to data corruption, crashes, or arbitrary code execution, compromising the security of the affected systems.
If an immediate update is not possible, consider restricting access to the bsdiff tool and avoid using it with untrusted inputs.
The CVSS score of CVE-2020-14315 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for bsdiff.
