CVE-2020-37182: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-37182 is a stack-based buffer overflow vulnerability in Redir 3.3, a TCP port redirector for UNIX, affecting the doproxyconnect() function. The flaw allows unauthenticated remote attackers to crash the application by sending oversized input, exploiting an unchecked sprintf() call that overwrites stack memory and triggers a segmentation fault. It was publicly disclosed on February 11, 2026, and tracked by Red Hat's security team. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-120 (Buffer Copy without Checking Size of Input). Within the doproxyconnect() function in redir.c, a call to sprintf() copies attacker-controlled input into a fixed-size stack buffer without validating the input length, allowing the buffer to be overflowed. An unauthenticated remote attacker can trigger this by sending an oversized payload to the Redir service over the network, requiring no special privileges or user interaction. No public proof-of-concept exploit code has been identified at this time (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in a segmentation fault and immediate termination of the Redir process, causing a denial of service for all users relying on the TCP port redirection service. Because the attack is network-accessible and requires no authentication, it can be repeatedly triggered to maintain a persistent denial of service condition. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Bugzilla, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability has an EPSS score of approximately 0.038%, indicating a low probability of near-term exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploit maturity, the attack vector is fully network-accessible with no authentication or user interaction required, lowering the barrier for exploitation (Red Hat CVE).

1. Reconnaissance: Identify hosts running Redir 3.3 by scanning for open TCP ports configured as Redir listeners (e.g., using Shodan, Censys, or nmap), looking for services that proxy connections through a CONNECT-style mechanism.
2. Identify proxy connect endpoint: Determine that the target Redir instance is configured to use a proxy (enabling the doproxyconnect() code path), which is triggered when Redir is set to forward connections through an HTTP proxy using the -x/--connect option.
3. Craft oversized payload: Construct a TCP payload containing an oversized string (exceeding the fixed stack buffer size) intended to be processed by the sprintf() call within doproxyconnect().
4. Send malicious input: Connect to the Redir listening port and transmit the oversized payload, causing sprintf() to overflow the stack buffer.
5. Trigger crash: The stack overflow corrupts memory, causing a segmentation fault and terminating the Redir process, resulting in denial of service for all proxied connections (Red Hat Bugzilla).

• Network: Unexpected or repeated TCP connections to the Redir listening port from external or untrusted IP addresses, particularly with unusually large payloads in the initial connection data.
• Logs: Syslog entries showing Redir process crashes or restarts (e.g., segmentation fault messages from the OS or process supervisor); absence of expected Redir log entries following a crash.
• Process: Redir process unexpectedly absent from the process list (ps aux | grep redir); process supervisor (e.g., systemd, inetd) logs showing repeated service restarts due to abnormal exit codes.

Organizations running Redir 3.3 should upgrade to a patched version as soon as one becomes available; patch details are tracked under Red Hat Bugzilla Bug 2439177. As an interim workaround, implement network-level access controls (e.g., firewall rules, TCP wrappers, or xinetd restrictions) to limit connections to the Redir service to trusted IP addresses only. Disabling the proxy connect feature (-x/--connect option) if not required will eliminate the vulnerable code path entirely (Red Hat Bugzilla, Red Hat CVE).