CVE-2021-20201: 
NixOS vulnerability analysis and mitigation

CVE-2021-20201 is a vulnerability discovered in SPICE (Simple Protocol for Independent Computing Environments) versions before 0.14.92. The vulnerability affects the remote display system built for virtual environments that allows users to view computing desktops from anywhere on the Internet (Red Hat Advisory).

The vulnerability involves a flaw in the TLS renegotiation mechanism where remote attackers can cause a denial of service through CPU consumption by performing multiple renegotiations within a single connection. The issue has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

When exploited, this vulnerability can lead to denial of service through excessive CPU consumption on affected servers. The attack is particularly effective because it can be executed over a single TCP connection, making it harder for external DoS mitigation tools to detect (Qualys Blog).

The vulnerability is exploitable remotely and requires no authentication. The attack can be executed by requesting many new SSL connections per second or by using the renegotiation feature to force a server to perform multiple expensive cryptographic operations over a single TCP connection (Qualys Blog).

The vulnerability has been fixed in SPICE version 0.14.92 and later. For affected systems, it is recommended to upgrade to the patched version. For Red Hat Enterprise Linux users, updates are available through RHSA-2021:1924. Gentoo users should upgrade to version 0.15.0 or later (Gentoo Advisory, Red Hat Advisory).