CVE-2020-6106
NixOS vulnerability analysis and mitigation

Overview

An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck versions 1.12 and 1.13. The vulnerability was discovered by Lilith of Cisco Talos and publicly disclosed on October 14, 2020. The F2fs-tools set of utilities is specifically used for creating, checking and fixing Flash-Friendly File System (F2FS) files, which has been increasingly replacing ext4 in embedded devices (Talos Report).

Technical details

The vulnerability exists in the init_node_manager function where an out-of-bounds heap read can occur. The issue stems from insufficient validation of the nat_ver_bitmap_bytesize field, which controls the size of memory allocation and copying operations. The vulnerability has a CVSS v3.1 base score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating local access is required with user interaction (NVD, Talos Report).

Impact

The vulnerability allows an attacker to disclose sensitive information through a specially crafted filesystem. This is particularly concerning in Android devices where f2fs.fsck is executed on boot for the /data partition, potentially allowing an attacker to gain privileges during boot and bypass Android verified boot protections (Talos Report).

Exploitability

Exploitation requires either physical access to an Android device or temporary root access in a context that allows writing to block devices from the Android OS. The attacker needs to provide a malicious file to trigger the vulnerability. The vulnerability has been assigned CWE-131 (Incorrect Calculation of Buffer Size) (Talos Report).

Mitigation and workarounds

Users should upgrade to F2fs-tools version 1.14.0 or later which contains fixes for this vulnerability. For Gentoo users, the recommended action is to emerge the latest version using the command: emerge --ask --oneshot --verbose ">=sys-fs/f2fs-tools-1.14.0" (Gentoo Advisory).

Additional resources


SourceThis report was generated using AI

Related NixOS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-75874CRITICAL10
  • NixOS logoNixOS
  • cpe:2.3:a:mozilla:firefox
NoYesAug 18, 2026
CVE-2026-74990CRITICAL9.8
  • NixOS logoNixOS
  • thunderbird
NoYesAug 18, 2026
CVE-2026-74989CRITICAL9.8
  • NixOS logoNixOS
  • thunderbird
NoYesAug 18, 2026
CVE-2026-74988CRITICAL9.8
  • NixOS logoNixOS
  • thunderbird
NoYesAug 18, 2026
CVE-2026-74987CRITICAL9.8
  • NixOS logoNixOS
  • MozillaFirefox
NoYesAug 18, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management