CVE-2020-6106: 
NixOS vulnerability analysis and mitigation

An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck versions 1.12 and 1.13. The vulnerability was discovered by Lilith of Cisco Talos and publicly disclosed on October 14, 2020. The F2fs-tools set of utilities is specifically used for creating, checking and fixing Flash-Friendly File System (F2FS) files, which has been increasingly replacing ext4 in embedded devices (Talos Report).

The vulnerability exists in the init_node_manager function where an out-of-bounds heap read can occur. The issue stems from insufficient validation of the nat_ver_bitmap_bytesize field, which controls the size of memory allocation and copying operations. The vulnerability has a CVSS v3.1 base score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating local access is required with user interaction (NVD, Talos Report).

The vulnerability allows an attacker to disclose sensitive information through a specially crafted filesystem. This is particularly concerning in Android devices where f2fs.fsck is executed on boot for the /data partition, potentially allowing an attacker to gain privileges during boot and bypass Android verified boot protections (Talos Report).

Exploitation requires either physical access to an Android device or temporary root access in a context that allows writing to block devices from the Android OS. The attacker needs to provide a malicious file to trigger the vulnerability. The vulnerability has been assigned CWE-131 (Incorrect Calculation of Buffer Size) (Talos Report).

Users should upgrade to F2fs-tools version 1.14.0 or later which contains fixes for this vulnerability. For Gentoo users, the recommended action is to emerge the latest version using the command: emerge --ask --oneshot --verbose ">=sys-fs/f2fs-tools-1.14.0" (Gentoo Advisory).