CVE-2020-6078: Null Pointer Dereference
An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdnsrecv, the return value of the mdnsreadheader function is not checked, leading to an uninitialized variable usage that eventually results in a null pointer dereference, leading to service crash. An attacker can send a series of mDNS messages to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vlcto a version that resolves this vulnerability.Fixed in 3.0.17.4-0+deb10u1Fixed in 3.0.17.4-0+deb10u2Fixed in 3.0.18-0+deb11u1Fixed in 3.0.18-2Fixed in 3.0.19-1 - Upgrade
Upgrade
Videolabs libmicrodnsto a version that resolves this vulnerability.Fixed in 0.1.0 - Compensating control
Mitigate the mDNS DoS by restricting/blocking mDNS traffic (UDP 5353) to trusted networks/sources until the libmicrodns message-parsing issue in mdns_recv (mdns_read_header return value check) is fixed.
Event History
Frequently Asked Questions
What is CVE-2020-6078?
CVE-2020-6078 is a denial-of-service vulnerability in the message-parsing functionality of Videolabs libmicrodns 0.1.0.
What is the severity of CVE-2020-6078?
CVE-2020-6078 has a severity rating of 7.5 (high).
How does CVE-2020-6078 affect the affected software?
CVE-2020-6078 affects Videolabs libmicrodns 0.1.0 and Debian Debian Linux 9.0 and 10.0, as well as VLC versions 3.0.17.4-0+deb10u1, 3.0.17.4-0+deb10u2, 3.0.18-0+deb11u1, 3.0.18-2, and 3.0.19-1.
How can I fix CVE-2020-6078?
To fix CVE-2020-6078, it is recommended to update the affected software to the latest versions available.
Where can I find more information about CVE-2020-6078?
You can find more information about CVE-2020-6078 at the following references: [link1](https://talosintelligence.com/vulnerability_reports/TALOS-2020-1001), [link2](https://security-tracker.debian.org/tracker/CVE-2020-6078), [link3](https://security.gentoo.org/glsa/202005-10).