CVE-2020-14398: 
NixOS vulnerability analysis and mitigation

An issue was discovered in LibVNCServer before 0.9.13 where an improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c. The vulnerability was disclosed on June 17, 2020, and affects multiple systems including Ubuntu, OpenSUSE, and Siemens industrial products (NVD, Ubuntu).

The vulnerability occurs when a TCP connection is not reset properly at the TCP level (e.g., due to sudden power loss or process crash). In such cases, the connection becomes half-open, causing read() to always return -1 with errno = EAGAIN while select() always returns 0. This leads to an infinite loop in the libvncclient/sockets.c file. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

A remote attacker could exploit this vulnerability to cause a denial of service condition by triggering an infinite loop in the application. This would result in the affected system becoming unresponsive (Ubuntu).

The vulnerability can be exploited remotely without requiring any privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

The vulnerability was fixed in LibVNCServer version 0.9.13. The fix involves implementing a timeout mechanism for handling half-open TCP connections. The patch adds a readTimeout parameter and closes the connection after a certain number of retries has been exceeded (GitHub). Users are advised to upgrade to the fixed version or apply the available security updates for their respective systems.