Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2020-36428
CVE-2020-36428:
NixOS vulnerability analysis and mitigation
Overview
CVE-2020-36428 affects matio (MAT File I/O Library) versions 1.5.18 through 1.5.21. The vulnerability was discovered on July 14, 2020, and involves a heap-based buffer overflow in the ReadInt32DataDouble function, which is called from ReadInt32Data and Mat_VarRead4 (OSS-Fuzz).
Technical details
The vulnerability is a heap-based buffer overflow that occurs in the ReadInt32DataDouble function of matio. The issue is triggered when processing specific MAT file inputs, leading to a WRITE overflow of 4 bytes. The vulnerability chain involves the functions ReadInt32DataDouble, ReadInt32Data, and Mat_VarRead4 (OSS-Fuzz-Vulns).
Impact
The heap buffer overflow vulnerability could potentially lead to memory corruption, which may result in program crashes or potential code execution. The severity is rated as HIGH according to the ecosystem assessment (OSS-Fuzz-Vulns).
Exploitability
The vulnerability was discovered through OSS-Fuzz testing and was confirmed to be reproducible. The issue was introduced in commit 651a8e28099edb5fbb9e4e1d4d3238848f446c9a and later fixed in commit cddcdad17864c4b95ead23581047b41636f180a3 (OSS-Fuzz-Vulns).
Mitigation and workarounds
The vulnerability has been fixed in versions after 1.5.21. Users should upgrade to a patched version of matio beyond version 1.5.21 (OSS-Fuzz-Vulns).
Additional resources
Source: This report was generated using AI
Related NixOS vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management