CVE-2020-8252: fs.realpath.native may cause buffer overflow
A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
fs.realpath.native on may cause buffer overflow
— Node.Js
libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
All versions of the 10.x release line
All versions of the 12.x release line
All versions of the 14.x release line before 14.9.0
— Node.Js
libuv's realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow.
Upstream advisory:
https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/
— Red Hat
Node.js is vulnerable to a buffer overflow, caused by improper bounds checking by the libuv's fs.realpath.native. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
— IBM
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-nodejs12-nodejsto a version that resolves this vulnerability.Fixed in 0:12.18.4-3.el7 - Upgrade
Upgrade
redhat/rh-nodejs10-nodejsto a version that resolves this vulnerability.Fixed in 0:10.23.1-2.el7 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 12.18.4 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 10.22.1 - Upgrade
Upgrade
redhat/libuvto a version that resolves this vulnerability.Fixed in 1.39.0 - Upgrade
Upgrade
debian/libuv1to a version that resolves this vulnerability.Fixed in 1.40.0-2+deb11u1Fixed in 1.44.2-1+deb12u1Fixed in 1.50.0-2Fixed in 1.51.0-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.22.1Fixed in 12.18.4Fixed in 14.9.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.22.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.18.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.9.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8252?
CVE-2020-8252 is a vulnerability in the realpath() implementation in libuv, which can lead to a potential buffer overflow.
What is the impact of CVE-2020-8252?
The highest threat from CVE-2020-8252 is to data confidentiality and integrity, as well as system availability.
Which software is affected by CVE-2020-8252?
Node.js versions < 10.22.1, < 12.18.4, and < 14.9.0, as well as libuv versions < 1.39.0, are affected by CVE-2020-8252.
How can I fix CVE-2020-8252?
To fix CVE-2020-8252, update Node.js to version 10.22.1, 12.18.4, or 14.9.0, and update libuv to version 1.39.0.
Where can I find more information about CVE-2020-8252?
You can find more information about CVE-2020-8252 on the Node.js and libuv websites.