Vulnerability   
Search   
    Search 191973 CVE descriptions
and 86218 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.1.2.2020.2409
Category:Huawei EulerOS Local Security Checks
Title:Huawei EulerOS: Security Advisory for cryptsetup (EulerOS-SA-2020-2409)
Summary:The remote host is missing an update for the Huawei EulerOS; 'cryptsetup' package(s) announced via the EulerOS-SA-2020-2409 advisory.
Description:Summary:
The remote host is missing an update for the Huawei EulerOS
'cryptsetup' package(s) announced via the EulerOS-SA-2020-2409 advisory.

Vulnerability Insight:
A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement 'intervals = malloc(first_backup * sizeof(*intervals)),'). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.(CVE-2020-14382)

Affected Software/OS:
'cryptsetup' package(s) on Huawei EulerOS V2.0SP9.

Solution:
Please install the updated package(s).

CVSS Score:
6.8

CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2020-14382
CopyrightCopyright (C) 2020 Greenbone Networks GmbH

This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.