CVE-2020-37239
CriticalSummary
libbabl version 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection.
Risk Assessment
This vulnerability may lead to memory corruption and code execution, posing a serious threat to the integrity and security of the system.
Recommendation
It is recommended to update libbabl to the latest version to mitigate this vulnerability and implement additional memory monitoring and security mechanisms.
Original NVD description (English source)
libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection, as libc's malloc metadata overwrites babl's signature field upon freeing, enabling potential memory corruption and code execution.