CVE-2020-11940: 
NixOS vulnerability analysis and mitigation

In nDPI through 3.2 Stable, an out-of-bounds read vulnerability was discovered in the concat_hash_string function within ssh.c. This vulnerability can be exploited by a network-positioned attacker who can send malformed SSH protocol messages on a network segment monitored by nDPI's library (NVD, MITRE).

The vulnerability stems from insufficient bounds checking in the SSH protocol dissector. When processing SSH KEXINIT messages, the offset variable is calculated using integer arithmetic that is susceptible to integer overflow. The resulting offset value is then used as an index into packet data without proper bounds checking, which can lead to an out-of-bounds read condition. The vulnerability has a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (GitHub Security Lab).

The exploitation of this vulnerability may result in a Denial of Service (DoS) condition due to the out-of-bounds read access to memory. This can affect any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis (GitHub Security Lab).

The vulnerability can be exploited by a network-positioned attacker who can send malformed SSH protocol messages. The attacker needs to be able to send traffic to a network segment that is being monitored by a system using the affected nDPI library (GitHub Security Lab).

The vulnerability was addressed through a patch that implements systematic bounds checks in the concat_hash_string function. The fix was committed in the nDPI repository and is available in versions after 3.2 (GitHub Commit).