CVE-2020-26164: 
Linux Debian vulnerability analysis and mitigation

In kdeconnect-kde (aka KDE Connect) before version 20.08.2, a vulnerability was discovered that allowed attackers on the local network to send crafted packets triggering excessive resource consumption. The vulnerability, identified as CVE-2020-26164, was discovered by Matthias Gerstner and the openSUSE security team, and was disclosed on October 2, 2020 (KDE Advisory).

The vulnerability stems from multiple security issues in the kdeconnectd network daemon, which listens on TCP and UDP port 1716 and runs with user privileges. The issues include: lack of message size limits, unlimited parallel TCP connections, unrestricted UDP broadcast processing, and various implementation flaws in the network protocol handling. The vulnerability received a CVSS 3.1 score of 5.5 (Medium), with attack vector: Local, attack complexity: Low, privileges required: Low, and high impact on availability (Ubuntu CVE).

An attacker could exploit these vulnerabilities to cause denial of service conditions through multiple vectors: excessive CPU usage through infinite processing loops, memory exhaustion through unlimited message sizes, file descriptor exhaustion through unlimited TCP connections, and network amplification attacks. The service could also be exploited to leak username and hostname information, and trigger arbitrary outgoing TCP connections to other hosts in the network segment (OSS Security).

The vulnerability is exploitable by any attacker on the local network, requiring no authentication. The attack vectors include sending malformed packets, establishing multiple connections, and utilizing UDP broadcast messages. The vulnerability was particularly concerning as kdeconnectd was enabled by default in some distributions like openSUSE Leap 15.2 (OSS Security).

The issues were fixed in KDE Connect version 20.08.2. The fixes include implementing message size limits, connection limits, timeout mechanisms, and various protocol handling improvements. For users unable to update, the recommended workaround is to stop KDE Connect when on untrusted networks. Since the service is DBus activated, a complete mitigation requires uninstalling the kdeconnect package and running 'kquitapp5 kdeconnectd' (KDE Advisory).

The security community expressed concern about the default enablement of the service. Solar Designer, a prominent security researcher, commented that merely fixing the known issues doesn't address the fact that this poses unjustified risk for most people. In response, the openSUSE security team indicated they were working with the community to remove the attack surface by default while maintaining accessibility for interested users (OSS Security).