Cyber Resilience

CVE-2020-8794

Memory Safety in Canonical Ubuntu Linux 18.04 … 19.10

Public PoCHigh EPSSMemory Safety
Published
25 February 2020
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.89 99.8th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2020-8794 is a critical-severity Out-of-bounds Read (CWE-125) vulnerability in Canonical Ubuntu Linux. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches…

more

the client code during bounce handling.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Out-of-bounds read in OpenSMTPD MTA client code enables remote code execution against publicly exposed SMTP servers.
T1203 Exploitation for Client Execution Executionconfidence: MEDIUM
Exploitation of the client-side vulnerability during bounce handling can lead to arbitrary code execution on the server.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-41360Same product: Debian Debian Linux
CVE-2023-31122Same product: Debian Debian Linux
CVE-2023-4428Same product: Debian Debian Linux
CVE-2023-4761Same product: Debian Debian Linux
CVE-2024-27008Same product: Debian Debian Linux
CVE-2023-40188Same product: Debian Debian Linux
CVE-2023-4431Same product: Debian Debian Linux
CVE-2023-39356Same product: Debian Debian Linux
CVE-2023-39354Same product: Debian Debian Linux
CVE-2023-39353Same product: Debian Debian Linux

Affected Assets

opensmtpd
opensmtpd
≤ 6.6.4
canonical
ubuntu linux
18.04, 19.10
fedoraproject
fedora
31, 32
debian
debian linux
10.0, 9.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.

PR.PS-02 partial match
prevents

Routine patching replaces vulnerable code containing out-of-bounds read flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance includes fuzzing and static analysis that detect out-of-bounds read defects before release.

A.8.15 Logging partial match
detects

Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.

prevents

Secure development life cycle mandates input validation and bounds checking that directly prevent out-of-bounds reads.

prevents

Application security requirements include explicit bounds and memory-safety specifications that mitigate buffer over-reads.

prevents

Secure system architecture and engineering principles require memory-safe design patterns and runtime protections against out-of-bounds access.

prevents

Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds-checked reads, eliminating CWE-125.

References