CVE-2020-9272: 
NixOS vulnerability analysis and mitigation

CVE-2020-9272 is an out-of-bounds (OOB) read vulnerability discovered in ProFTPD version 1.3.7, specifically affecting the mod_cap module through the cap_text.c cap_to_text function. The vulnerability was discovered and reported by GitHub Security Lab team member Antonio Morales, and was publicly disclosed after a fix was developed (GitHub Issue).

The vulnerability occurs in the cap_to_text() function within cap_text.c when it calls getstateflags(caps, n). When getstateflags(cap_t caps, int capno) is called with capno equal to 37, isset_cap((__cap_s *)(&caps->set.inheritable),capno) expands to &((__cap_s *)(&caps->set.inheritable))->_blk[(37)>>5], accessing caps->set.inheritable[1] which is outside of the caps struct bounds (GitHub Issue).

The out-of-bounds read vulnerability results in accessing memory locations outside the boundaries of the caps struct variable. The vulnerability only affects the 'inheritable' member of the struct, not affecting 'set.effective' or 'set.permited' members (GitHub Issue).

The vulnerability has been assigned a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N), indicating it can be exploited remotely with low attack complexity and no authentication required (Rapid7).

The vulnerability has been fixed in ProFTPD version 1.3.6c. Users are advised to upgrade to this version or later. For Gentoo Linux users, the recommended mitigation is to upgrade using the command: emerge --sync && emerge --ask --oneshot --verbose ">=net-ftp/proftpd-1.3.6c" (Gentoo Security).