CVE-2020-12762: 
NixOS vulnerability analysis and mitigation

CVE-2020-12762 affects json-c through version 0.14 and libfastjson. The vulnerability was discovered in May 2020 and involves an integer overflow and out-of-bounds write vulnerability that can be triggered via a large JSON file, specifically demonstrated through the printbuf_memappend function (NVD).

The vulnerability manifests in the printbuf_memappend function where properly crafted values can cause p->bpos + size + 1 to overflow, leading to incorrect assumptions about p->size being large enough. While json_object_from_fd typically prevents this through buffer size checks, the overflow can be exploited when parsed buffer chunk length is not a power of 2 (GitHub PR).

Successful exploitation of this vulnerability could lead to denial of service, disclosure of sensitive information, addition or modification of data, or potentially arbitrary code execution. The CVSS score is 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NetApp Advisory).

The vulnerability can be triggered if an attacker has control over the input stream or if a huge load during filesystem operations can be triggered. A proof of concept exploit has been publicly demonstrated that causes program crashes, with potential for more sophisticated attacks that could write attacker-controlled bytes outside allocated memory areas (GitHub PR).

The vulnerability was fixed in json-c version 0.14-r3 and later releases. Users are advised to upgrade to patched versions. For Debian systems, fixes were released as version 0.11-4+deb8u2 for Jessie, 0.12.1-1.1+deb9u1 for Stretch, and 0.12.1+ds-2+deb10u1 for Buster. Ubuntu systems received fixes through USN-4360-1 and USN-4360-4 (Debian Security, Ubuntu Security).