CVE-2020-27795: 
NixOS vulnerability analysis and mitigation

A segmentation fault vulnerability was discovered in radare2 with the adf command (CVE-2020-27795). The issue exists in libr/core/cmd_anal.c, where when the 'adf' command is used with no or wrong arguments, the anal_fcn_data function returns a null pointer for fcn, causing a segmentation fault in ensure_fcn_range function. This vulnerability affects versions up to (excluding) 4.4.0 (NVD).

The vulnerability occurs in the anal_fcn_data function within libr/core/cmd_anal.c. When executing the adf command without proper arguments, the function r_anal_get_fcn_in(core->anal, core->offset, -1) returns a null pointer, which later causes a segmentation fault in ensure_fcn_range(fcn). The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 HIGH with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability leads to a segmentation fault, causing the application to crash. This results in a denial of service condition, affecting the availability of the radare2 system (NVD).

The vulnerability can be triggered by simply executing the 'adf' command without arguments or with incorrect arguments in radare2. The proof of concept is straightforward: launching r2 and executing 'adf' command will result in a segmentation fault (GitHub Issue).

The vulnerability was fixed in radare2 version 4.4.0. The fix involves modifying the r_anal_get_fcn_in function call to include R_ANAL_FCN_TYPE_ANY as a parameter instead of -1, and restructuring the code to handle the fcn_size calculation after validating that fcn is not null (GitHub Patch).