CVE-2020-27350: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-27350 is a vulnerability discovered in APT (Advanced Package Tool) affecting multiple versions including apt 1.2.32ubuntu0, 1.6.12ubuntu0, 2.0.2ubuntu0, and 2.1.10ubuntu0. The vulnerability was identified by Kevin Backhouse and involves integer overflows and underflows while parsing .deb packages in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc (GitHub Security Lab).

The vulnerability stems from integer overflows in the arfile.cc implementation. Specifically, a negative integer overflow can occur at arfile.cc line 116 with the operation 'Memb->Size -= Len', leading to a value of 0xFFFFFFFFFFFFFFFF. This subsequently causes an out-of-memory error when attempting to allocate memory with 'char* value = new char[member->Size]'. The vulnerability has been assigned a CVSS score of 5.7 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L (NetApp Security).

When successfully exploited, this vulnerability could lead to a denial of service condition by causing APT to crash or stop responding. The impact is particularly concerning for archive management systems like Launchpad, where it could affect package processing queues (GitHub Security Lab).

The vulnerability can be exploited by a local attacker using specially crafted .deb packages. No privileged access is required to trigger the vulnerability, as the parsing of .deb files occurs before privilege checks. The vulnerability has been confirmed to be exploitable through the APT daemon's InstallFile method via dbus (Ubuntu Security Notice).

The vulnerability has been patched in multiple versions: Ubuntu 20.10 (apt 2.1.10ubuntu0.1), Ubuntu 20.04 (apt 2.0.2ubuntu0.2), Ubuntu 18.04 (apt 1.6.12ubuntu0.2), and Ubuntu 16.04 (apt 1.2.32ubuntu0.2). For Debian's stable distribution (buster), the fix was released in version 1.8.2.2. Users are recommended to update their systems to these patched versions through standard system updates (Debian Security Advisory).