CVE-2020-13558: 
NixOS vulnerability analysis and mitigation

A code execution vulnerability (CVE-2020-13558) was discovered in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. The vulnerability was identified in the way the WebAudio API interface handles its internal notification mechanism, specifically in the AudioSourceProviderGStreamer/MediaElementAudioSourceNode component (Talos Report).

The vulnerability is a use-after-free issue in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in versions prior to 2.30.5. The issue occurs because there is no validation of references to MediaElementAudioSourceNode during standard WebAudio processing before handling notifications. The vulnerability has a CVSS v3.1 score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Ubuntu Security).

The vulnerability could allow an attacker to execute arbitrary code through a specially crafted web page. The impact affects confidentiality, integrity, and availability with high severity levels. With proper heap grooming, an attacker could potentially gain full control of the use-after-free vulnerability, leading to arbitrary code execution (Talos Report).

The vulnerability can be triggered through a specially crafted web page that exploits the AudioSourceProviderGStreamer functionality. The exploit requires user interaction (visiting the malicious webpage) but no special privileges. The attack vector is network-based with low attack complexity (Ubuntu Security).

The vulnerability has been fixed in WebKitGTK version 2.30.5. Users and administrators are advised to upgrade to this version or later. The fix has been implemented across multiple distributions including Ubuntu, where it has been patched in versions 2.30.5-0ubuntu0.20.04.1 for focal and 2.30.5-0ubuntu0.18.04.1 for bionic (Ubuntu Security).