CVE-2020-28928: 
NixOS vulnerability analysis and mitigation

CVE-2020-28928 affects musl libc through version 1.2.1. The vulnerability involves the wcsnrtombs function mishandling particular combinations of destination buffer size and source character limit, which can lead to an invalid write access (buffer overflow) (NVD, Openwall).

The vulnerability exists in the wcsnrtombs function implementation in musl libc. The function has multiple bugs in handling destination buffer size when limiting the input character count. This can result in either an infinite loop with no forward progress (no overflow) or writing past the end of the destination buffer. The non-input-limiting form wcsrtombs is not affected by this vulnerability. The issue has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to buffer overflow conditions when the wcsnrtombs function is called with specific combinations of destination buffer size and source character limit parameters. While this function is not used internally in musl and is not widely used, it may affect applications that directly utilize this function (Openwall).

The vulnerability requires local access and low complexity to exploit. It cannot be triggered remotely without authentication. The function must be explicitly called with specific parameter combinations to trigger the vulnerability (NVD).

The issue was fixed in musl version 1.2.2, which includes a complete rewrite of the wcsnrtombs implementation. All users of musl 1.2.1 and prior versions should upgrade to version 1.2.2 or apply the provided patch that replaces the complex and erroneous implementation (Openwall, Musl Releases).