CVE-2020-36401: 
NixOS vulnerability analysis and mitigation

CVE-2020-36401 is a double free vulnerability discovered in mruby version 2.1.2. The vulnerability specifically occurs in the mrb_default_allocf function, which is called from mrb_free and obj_free functions. The issue was disclosed and published on June 30, 2021 (NVD).

The vulnerability is classified as a double free issue (CWE-415) that occurs in the memory allocation functionality of mruby. The CVSS v3.1 base score is 7.8 (HIGH), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue specifically manifests in the mrb_default_allocf function when it's invoked through the call chain of mrb_free and obj_free (OSS Fuzz).

The vulnerability can lead to memory corruption through double freeing of memory allocations, potentially resulting in program crashes or arbitrary code execution. The CVSS scoring indicates high potential impact on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires local access and user interaction to be exploited, as indicated by the CVSS metrics (AV:L/AC:L/PR:N/UI:R). The issue was discovered through OSS-Fuzz testing and has been documented in their bug tracking system (OSS Fuzz).

The vulnerability has been fixed in a subsequent release through commit 97319697c8f9f6ff27b32589947e1918e3015503, which removes an unnecessary free operation in the realloc function to prevent the double-free condition. Users should upgrade from version 2.1.2 to a patched version (GitHub Patch).