CVE-2020-14315
📋 TL;DR
CVE-2020-14315 is a critical memory corruption vulnerability in bspatch (part of bsdiff tools) that allows attackers to write outside allocated buffer boundaries. This can lead to arbitrary code execution or application crashes. Anyone using bsdiff version 4.3 or systems that incorporate this library for patch operations is affected.
💻 Affected Systems
- bsdiff
- bspatch
- systems using bsdiff library for binary patching
📦 What is this software?
Bsdiff by Daemonology
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Application crash leading to denial of service, with potential for limited code execution depending on memory layout and exploit sophistication.
If Mitigated
No impact if vulnerable bspatch is not used or if input validation prevents malicious patch files from being processed.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available. Attackers can craft malicious patch files that trigger the buffer overflow when processed by vulnerable bspatch.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: bsdiff 4.4 or later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1856747
Restart Required: No
Instructions:
1. Download bsdiff 4.4 or later from official sources. 2. Replace existing bspatch binary with patched version. 3. Recompile any applications that statically link bsdiff library. 4. Verify patch application with test cases.
🔧 Temporary Workarounds
Input validation for patch files
allImplement strict validation of patch files before processing with bspatch
# Add checksum verification: sha256sum patchfile.bspatch
# Validate patch file size and structure before processing
Sandbox bspatch execution
linuxRun bspatch in isolated containers or with reduced privileges
# Run with seccomp-bpf: bwrap --unshare-all --dev-bind / / --ro-bind /usr/bin/bspatch /usr/bin/bspatch bspatch oldfile newfile patchfile
# Use Docker: docker run --read-only -v $(pwd):/data:ro alpine bspatch /data/old /data/new /data/patch
🧯 If You Can't Patch
- Disable automatic patch processing from untrusted sources
- Implement network segmentation to isolate systems using bspatch
🔍 How to Verify
Check if Vulnerable:
Check bsdiff version: bspatch --version 2>&1 | grep -i versionCheck Version:
bspatch --version 2>&1 || echo "bsdiff not installed"Verify Fix Applied:
Verify version is 4.4 or later and test with known safe patch files📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or memory error logs from bspatch process
- Unexpected process termination of bspatch or related applications
Network Indicators:
- Unusual network transfers of patch files to systems running bspatch
- Patch files from untrusted sources being downloaded
SIEM Query:
process_name="bspatch" AND (event_type="crash" OR exit_code="139")🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1856747
- https://www.openwall.com/lists/oss-security/2020/07/09/2
- https://www.x41-dsec.de/lab/advisories/x41-2020-006-bspatch/
- https://bugzilla.redhat.com/show_bug.cgi?id=1856747
- https://www.openwall.com/lists/oss-security/2020/07/09/2
- https://www.x41-dsec.de/lab/advisories/x41-2020-006-bspatch/
