CVE-2020-15121: 
NixOS vulnerability analysis and mitigation

CVE-2020-15121 affects radare2 versions before 4.5.0, where malformed PDB file names in the PDB server path could cause shell injection. The vulnerability was discovered and disclosed in May 2020, with a fix released in version 4.5.0 in July 2020. The issue affects the radare2 reverse engineering framework and its PDB (Program Database) file handling functionality (GitHub Advisory, NVD).

The vulnerability exists in the PDB downloader component of radare2, specifically in the command execution path for downloading PDB files. When processing PDB file names, the application failed to properly escape special characters, leading to potential shell command injection. The vulnerability has a CVSS v3.1 Base Score of 9.6 (CRITICAL) according to NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. GitHub's assessment rated it slightly lower at 7.4 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N (NVD).

If exploited, this vulnerability allows attackers to execute arbitrary shell commands through specially crafted PDB file names. The impact is demonstrated by the ability to create files on the target system, indicating potential for more severe command execution capabilities. The vulnerability requires user interaction in the form of opening an executable in radare2 and running the idpd command (GitHub Issue).

The vulnerability can be triggered by opening an executable with malformed debug symbol information in radare2 and running the idpd command. A proof-of-concept exploit involves patching a PE file's dbg_file field with a malicious command like $(touch pwned), which would execute when the PDB download is attempted (GitHub Advisory).

The primary mitigation is to upgrade to radare2 version 4.5.0 or later, which contains the fix for this vulnerability. For users unable to upgrade immediately, a workaround is available by setting e bin.dbginfo=false in $HOME/.config/radare2/radare2rc to disable PDB autoloading and avoiding manual use of the idpd command (GitHub Advisory).

The vulnerability was addressed promptly by the radare2 team, with distributions like Fedora quickly releasing security updates to address the issue. Fedora released updates for both Fedora 31 and 32, incorporating the fix along with other improvements (Fedora Update).