CVE-2019-20918: 
NixOS vulnerability analysis and mitigation

An issue was discovered in InspIRCd 3 before version 3.1.0, specifically affecting versions 3.0.0 and 3.0.1. The vulnerability exists in the silence module which contains a use after free vulnerability (InspIRCd Docs, NVD). The vulnerability was disclosed on September 11, 2020.

The vulnerability is a use-after-free condition in the silence module of InspIRCd. The issue was introduced in version 3.0.0 and was fixed by modifying how silence flags are handled when sending update notifications (GitHub Fix).

This vulnerability can be exploited to remotely crash an InspIRCd server. The attack can be executed by any user who has the ability to fully connect to the server (InspIRCd Docs).

The vulnerability is relatively easy to exploit as it only requires the attacker to have the ability to connect to the IRC server. No special privileges beyond basic server connection are required (InspIRCd Docs).

The vulnerability was fixed in InspIRCd version 3.1.0, released on May 17, 2019. For users unable to upgrade, the recommended workaround is to unload the silence module (InspIRCd Docs).