CVE-2020-35680: 
NixOS vulnerability analysis and mitigation

OpenSMTPD before version 6.8.0p1, specifically in the smtpd/lka_filter.c component, contains a vulnerability that affects certain configurations. The vulnerability was discovered and disclosed on December 24, 2020. The issue affects the filter state machine's handling of I/O channels between the SMTP engine and the filters layer (NVD, CVE).

The vulnerability stems from a logic issue in the filters state machine where the I/O channel between the SMTP engine and the filters layer could be prematurely released while filters were still processing a request. This would result in a NULL pointer dereference when filters attempted to return results. The issue has a CVSS v3.1 base score of 7.5 (High), with attack vector being Network, attack complexity Low, and requiring no privileges or user interaction (Ubuntu).

When successfully exploited, the vulnerability allows remote attackers to cause a denial of service condition through a crafted pattern of client activity. The impact is primarily focused on service availability, with no reported effects on confidentiality or integrity of the system (NVD, Ubuntu).

The vulnerability can be triggered by remote attackers connecting to the SMTP listener daemon through a specific pattern of client activity. The bug requires a specific configuration and client pattern to trigger, and not all OpenSMTPD setups are affected. Default installations were reported to be unaffected (Poolp Blog).

The vulnerability was fixed in OpenSMTPD version 6.8.0p1 and later. Users are advised to upgrade to version 6.8.0p2 or later. The fix addresses the filter state machine issue by properly maintaining the I/O channel between the SMTP engine and filters layer (OpenSMTPD Announce, Gentoo Security).