CVE-2020-9861: 
NixOS vulnerability analysis and mitigation

A stack overflow vulnerability (CVE-2020-9861) was discovered in Swift for Linux versions up to and including 5.1.4. The vulnerability existed in the JSONSerialization component when parsing deeply nested malicious JSON input. The issue was disclosed on March 13, 2020, and was addressed with improved input validation in Swift 5.1.5 (Swift Forums, NVD).

The vulnerability is classified as an Uncontrolled Recursion issue (CWE-674). When parsing JSON input using JSONSerialization or JSONDecoder, the application could be forced into arbitrarily deep recursion, potentially leading to a stack overflow. The vulnerability received a CVSS v3.1 base score of 7.5 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it is network accessible with low attack complexity and requires no privileges or user interaction (NVD).

The successful exploitation of this vulnerability could lead to a denial-of-service condition through process crashes caused by stack overflow. The vulnerability affects the availability of the system without compromising confidentiality or integrity (NVD).

The vulnerability is remotely exploitable without authentication. An attacker who can provide JSON input to be parsed by the affected JSONSerialization component can trigger the vulnerability by submitting deeply nested malicious JSON data (Swift Forums).

Users are advised to upgrade to Swift 5.1.5 or later versions, which include the security fix. The update can be obtained by downloading packages from Swift.org or using the latest docker images. The fix implements improved input validation for handling deeply nested JSON input (Swift Forums).

The vulnerability was initially reported by Fabian Fett, and the Swift team acknowledged the report and promptly released a fix. The issue was subsequently assigned CVE-2020-9861 to track the vulnerability (Swift Forums).