CVE-2020-6108: 
NixOS vulnerability analysis and mitigation

An exploitable code execution vulnerability exists in the fsck_chk_orphan_node functionality of F2fs-Tools F2fs.Fsck 1.13. The vulnerability was discovered in May 2020 and publicly disclosed on October 14, 2020. The vulnerability affects the F2fs-Tools package, specifically the fsck.f2fs binary used for checking and fixing Flash-Friendly File System (F2FS) partitions. This file system has been increasingly replacing ext4 in embedded devices, particularly for eMMC chips and SD cards (Talos Report).

The vulnerability exists in the fsck_chk_orphan_node functionality where a specially crafted f2fs filesystem can cause a heap buffer overflow. The issue stems from the lack of validation on the entry_count member of the f2fs_orphan_block struct. The vulnerability involves two key components: an out-of-bounds read where the j variable has an upper bound of entry_count, and an out-of-bounds write that occurs only if certain sanity checks pass. The vulnerability has been assigned a CVSSv3 score of 8.2 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and is classified as CWE-131 (Incorrect Calculation of Buffer Size) (Talos Report).

If exploited, this vulnerability could lead to code execution in the context of fsck.f2fs. On Android devices using F2FS for the /data partition, the vulnerability could be particularly impactful as fsck.f2fs is executed during boot. This could allow an attacker to gain privileges during boot and potentially bypass Android verified boot, though this would require either physical access to the device or temporary root access (Talos Report).

The vulnerability is exploitable through a specially crafted f2fs filesystem. An attacker can manipulate the read pointer to move ahead of the write pointer, allowing for storage of arbitrary memory in unused heap areas. The attacker can also control the amount of orphan pages to reset the out-of-bounds pointers while maintaining the read pointer's position, enabling overwriting of memory with desired values. Function pointers in the heap belonging to dict_t objects are potential targets for exploitation (Talos Report).

The vulnerability was addressed in F2fs-tools version 1.14.0. Users should upgrade to this version or later to mitigate the vulnerability (Gentoo Security).