CVE-2020-6096
Publication date 1 April 2020
Last updated 18 August 2025
Ubuntu priority
Description
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| eglibc | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty |
Vulnerable
|
|
| glibc | 26.10 stonking |
Fixed in 2.32-0ubuntu3
|
| 26.04 LTS resolute |
Fixed in 2.32-0ubuntu3
|
|
| 24.04 LTS noble |
Fixed in 2.32-0ubuntu3
|
|
| 22.04 LTS jammy |
Fixed in 2.32-0ubuntu3
|
|
| 20.04 LTS focal |
Fixed in 2.31-0ubuntu9.7
|
|
| 18.04 LTS bionic |
Fixed in 2.27-3ubuntu1.5
|
|
| 16.04 LTS xenial |
Fixed in 2.23-0ubuntu11.3
|
|
| 14.04 LTS trusty | Not in release |
Patch details
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.1 · High
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-4954-1
- GNU C Library vulnerabilities
- 14 May 2021
- USN-5310-1
- GNU C Library vulnerabilities
- 1 March 2022