CVE-2020-12861: 
Alibaba Cloud Linux (Aliyun Linux) vulnerability analysis and mitigation

A heap buffer overflow vulnerability (CVE-2020-12861) was discovered in SANE Backends before version 1.0.30. The vulnerability, also known as GHSL-2020-080, affects the epsonds backend and allows a malicious device connected to the same local network as the victim to execute arbitrary code (GitHub Security Lab, SANE Announce).

The vulnerability exists in the epsonds_net_read function where there is a heap buffer overflow at epsonds-net.c, line 135. The size value in the function is controlled by the attacker, allowing arbitrary amounts of attacker-controlled data to be written to s->netbuf. The vulnerability is triggered when an application such as simple-scan searches the network for scanners, which happens immediately at application startup (GitHub Security Lab). The vulnerability has been assigned a CVSS 3.1 base score of 8.8 (High) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Ubuntu Security).

The vulnerability can lead to remote code execution by an attacker on the same local network as the victim. For example, in a typical office environment, the malicious device would need to be somewhere inside the building. The vulnerability allows attackers to execute arbitrary code through a compromised network-connected device (GitHub Security Lab, Red Hat Security).

The vulnerability is particularly severe because it can be triggered automatically when applications like simple-scan start up and search for network scanners, requiring no user interaction. This makes it a zero-click vulnerability, as there isn't even a need to trick the user into thinking the scanner is genuine (GitHub Security Lab).

The vulnerability was fixed in SANE Backends version 1.0.30. Users are strongly recommended to upgrade to this version or later. The fix addresses the heap buffer overflow in the epsonds backend and includes additional security improvements (SANE Announce). Various Linux distributions have also released security updates to address this vulnerability, including Ubuntu, Red Hat, and openSUSE (Ubuntu Security, Red Hat Security).