CVE-2019-20840
📋 TL;DR
CVE-2019-20840 is a memory corruption vulnerability in LibVNCServer's WebSocket decoding functionality that can cause crashes due to unaligned memory accesses. This affects systems running vulnerable versions of LibVNCServer or software that incorporates it, potentially leading to denial of service. The vulnerability is triggered when processing WebSocket communications in the hybiReadAndDecode function.
💻 Affected Systems
- LibVNCServer
- Any software using LibVNCServer library
- VNC server implementations based on LibVNCServer
📦 What is this software?
Leap by Opensuse
Libvncserver by Libvnc Project
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this is theoretical and not demonstrated.
Likely Case
Denial of service through application crash when processing malicious WebSocket traffic.
If Mitigated
Minimal impact with proper network segmentation and updated software.
🎯 Exploit Status
The vulnerability is in WebSocket handling and requires sending specially crafted packets to trigger the crash.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.13 and later
Vendor Advisory: https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76
Restart Required: Yes
Instructions:
1. Update LibVNCServer to version 0.9.13 or later. 2. Recompile any applications using the library. 3. Restart affected services.
🔧 Temporary Workarounds
Disable WebSocket support
allDisable WebSocket protocol in LibVNCServer configuration to prevent exploitation
Configure LibVNCServer with -DisableWebSockets flag or equivalent configuration
Network filtering
linuxBlock WebSocket traffic to vulnerable VNC servers at network perimeter
iptables -A INPUT -p tcp --dport 5900 -m string --string "Sec-WebSocket-Key" --algo bm -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit VNC server exposure
- Monitor for crash events and implement application restart automation
🔍 How to Verify
Check if Vulnerable:
Check LibVNCServer version: ldd /path/to/vncserver | grep libvncserver, then check version in library metadataCheck Version:
vncserver --version 2>&1 | grep -i libvncserverVerify Fix Applied:
Verify version is 0.9.13 or higher: strings /usr/lib/libvncserver.so | grep 'LibVNCServer'📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- WebSocket connection errors in VNC server logs
Network Indicators:
- Malformed WebSocket packets to VNC ports
- Multiple connection attempts with unusual payloads
SIEM Query:
source="vnc.log" AND ("segmentation fault" OR "crash" OR "unaligned access")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76
- https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/
- https://usn.ubuntu.com/4434-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76
- https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/
- https://usn.ubuntu.com/4434-1/
