CVE-2019-20633 : Security Advisory and Response

GNU patch up to version 2.7.6 is vulnerable to a Double Free flaw in the function another_hunk in pch.c, potentially leading to a denial of service attack.

Understanding CVE-2019-20633

This CVE identifies a security vulnerability in GNU patch versions up to 2.7.6 that could be exploited by an attacker through a malicious patch file.

What is CVE-2019-20633?

The vulnerability, a Double Free flaw in the function another_hunk in pch.c, is a result of an incomplete fix for a previous CVE (CVE-2018-6952).

The Impact of CVE-2019-20633

Exploitation of this vulnerability could allow an attacker to execute a denial of service attack by crafting a malicious patch file.

Technical Details of CVE-2019-20633

Vulnerability Description

The vulnerability in GNU patch up to version 2.7.6 allows for a Double Free flaw in the function another_hunk in pch.c, potentially leading to a denial of service.

Affected Systems and Versions

Affected Version: GNU patch up to 2.7.6

Exploitation Mechanism

Attackers can exploit this vulnerability through a crafted patch file, leveraging the Double Free flaw to trigger a denial of service.

Mitigation and Prevention

Immediate Steps to Take

Apply patches or updates provided by the vendor to address the vulnerability.
Avoid applying patches from untrusted sources.

Long-Term Security Practices

Regularly update software to the latest versions to mitigate known vulnerabilities.
Implement proper security measures to prevent unauthorized access to systems.

Patching and Updates

Check for patches or updates released by GNU to fix the Double Free vulnerability in GNU patch up to version 2.7.6.