CVE-2020-15389: 
NixOS vulnerability analysis and mitigation

CVE-2020-15389 affects OpenJPEG through version 2.3.1. The vulnerability is a use-after-free issue located in jp2/opj_decompress.c that can be triggered when there is a mix of valid and invalid files in a directory operated on by the decompressor. The issue was discovered in June 2020 (Debian LTS).

The vulnerability occurs in the jp2/opj_decompress.c file when opj_image_destroy is called twice on the same image. The use-after-free specifically manifests as a read-after-free when opj_image_destroy attempts to read from the image after it has been freed. The issue emerges when there are multiple files in a directory, where at least one file has a valid header and another has an invalid header (Pastebin).

The vulnerability could result in denial of service or potentially lead to code execution in cases where malloc's freelist can be manipulated in a controlled manner. The CVSS 3.1 base score is 6.5 (Medium), with Network attack vector, High complexity, No privileges required, and No user interaction needed (Ubuntu CVE).

To exploit this vulnerability, an attacker must induce the target to run the decompressor on a crafted directory containing at least one valid .jp2 file and at least one invalid file. The exploit can be triggered using the command: ./opj_decompress -ImgDir Inputs/ -OutFor PGM (Pastebin).

Multiple distributions have released patches to address this vulnerability. Debian fixed the issue in version 2.1.2-1.1+deb9u5 for Stretch and 2.3.0-2+deb10u2 for Buster. Ubuntu has fixed the vulnerability across multiple versions including 2.3.1-1ubuntu4.20.04.1 for Ubuntu 20.04 LTS (Debian LTS, Ubuntu CVE).