CVE-2020-6107 - An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Too

CVE-2020-6107

Summary

An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause an uninitialized read resulting in an information disclosure. An attacker can provide a malicious file to trigger this vulnerability.

References

Vulnerable Configurations

cpe:2.3:a:f2fs-tools_project:f2fs-tools:1.12.0:*:*:*:*:*:*:*
cpe:2.3:a:f2fs-tools_project:f2fs-tools:1.12.0:*:*:*:*:*:*:*
cpe:2.3:a:f2fs-tools_project:f2fs-tools:1.13.0:*:*:*:*:*:*:*
cpe:2.3:a:f2fs-tools_project:f2fs-tools:1.13.0:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 12-05-2022 - 17:39)
Impact:
Exploitability:

CWE

CWE-754

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:N/A:N

refmap via4

misc

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1049

Last major update

12-05-2022 - 17:39

Published

15-10-2020 - 15:15

Last modified

12-05-2022 - 17:39