CVE-2020-15570: 
Linux Ubuntu vulnerability analysis and mitigation

The vulnerability (CVE-2020-15570) affects the parse_report() function in whoopsie.c in Whoopsie through version 0.2.69. The issue was discovered by Seong-Joong Kim and disclosed on July 6, 2020. Whoopsie, which serves as Ubuntu's error tracking daemon, is installed by default in both desktop and server installations (GitHub README, Ubuntu Notice).

The vulnerability stems from improper handling of memory allocation failures in the parse_report function. During the parsing of crash reports, the data length is not properly checked, allowing direct control over memory allocation size through input files. The function uses g_malloc or g_realloc based on unchecked data length values, which can lead to significant memory allocation issues (GitHub README).

When exploited, this vulnerability can cause the whoopsie daemon to consume excessive memory, potentially leading to system resource exhaustion and denial of service. The impact can range from application crashes to system hangs, and may even trigger the OOM (Out Of Memory) killer (GitHub README, Ubuntu Notice).

The vulnerability can be exploited by a local attacker through a malformed crash file placed in the /var/crash/ directory. The attacker can control the data length value to trigger excessive memory allocation, making the exploitation relatively straightforward (GitHub README).

The vulnerability has been patched in multiple Ubuntu versions. Users should update to the following versions: Ubuntu 20.04 LTS (whoopsie 0.2.69ubuntu0.1), Ubuntu 18.04 (whoopsie 0.2.62ubuntu0.5), and Ubuntu 16.04 (whoopsie 0.2.52.5ubuntu0.5). A standard system update will implement all necessary changes (Ubuntu Notice).