CVE-2020-6071: 
NixOS vulnerability analysis and mitigation

An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. The vulnerability (CVE-2020-6071) was discovered by Claudio Bozzato of Cisco Talos and disclosed on March 23, 2020. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking for recursion, which can lead to a denial of service condition. The vulnerability affects the libmicrodns library, which is used by VLC media player for mDNS services discovery (Talos Report, Talos Blog).

The vulnerability exists in the rr_decode function of libmicrodns, which parses domain name labels in mDNS messages. When processing compressed labels, the function follows compression pointers recursively without implementing any recursion checks. This allows an attacker to create a message with a label that points to itself, triggering infinite recursion that exhausts the program's stack. The vulnerability has been assigned a CVSSv3 score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is classified under CWE-674: Uncontrolled Recursion (Talos Report).

The vulnerability can be exploited to cause a denial of service condition by exhausting the program's stack through infinite recursion. This affects applications using the libmicrodns library, including VLC media player, potentially making them unresponsive or causing them to crash (NVD, Ubuntu Notice).

The vulnerability was patched by the vendor on March 20, 2020. Users should upgrade to libmicrodns version 0.1.2 or later. For systems unable to upgrade immediately, some distributions like Debian have mitigated the issue by disabling the microdns plugin in affected packages (Debian Advisory, Gentoo Advisory).