CVE-2020-10232: 
Linux Debian vulnerability analysis and mitigation

In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() function located in fs/yaffs.c. The vulnerability was discovered and disclosed on March 8, 2020 (CVE MITRE).

The vulnerability stems from an insufficient buffer size allocation in the yaffsfs_istat() function when parsing YAFFS file timestamps. The original implementation used a 32-byte buffer that was too small for the required operation. The fix involved increasing the buffer size to 128 bytes to accommodate the data needed by tsk_fs_time_to_str function (GITHUB COMMIT). The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical), indicating its severe nature (UBUNTU CVE).

The stack buffer overflow vulnerability could potentially lead to system compromise with high impacts on confidentiality, integrity, and availability. The CVSS scoring indicates that successful exploitation could result in high severity impacts across all three security metrics (UBUNTU CVE).

The vulnerability was patched in various Linux distributions. Debian released security updates DLA-2137-1 for Jessie and DLA-3054-1 for Stretch (DEBIAN LTS 2020, DEBIAN LTS 2022). Fedora released version 4.9.0-1 for Fedora 30, 31, and 32 to address this vulnerability (FEDORA UPDATE).