CVE-2020-12658 Race condition in n/a
A race condition in gssproxy worker threads may cause a denial of service by failing to release a mutex during shutdown.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12658?
CVE-2020-12658 is a critical vulnerability in Debian Debian Linux, published on 31 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.
Weakness: CWE-667
Which versions are affected by CVE-2020-12658?
It affects 2 products.
Linux distribution packages (4)
gssproxy SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 0.8.2-3.6.1 |
gssproxy SUSE:Linux Enterprise Server 12 SP5 | All versions | 0.8.2-4.5.1 |
gssproxy SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 0.8.2-4.5.1 |
gssproxy openSUSE:Leap 15.2 | All versions | 0.8.2-lp152.2.3.1 |
Products include Debian Debian Linux, Gssproxy Project Gssproxy.
How do I fix CVE-2020-12658?
Upgrade to a fixed version.
Is CVE-2020-12658 being exploited?
There is no known exploitation of CVE-2020-12658 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-12658, DLA-2516-1, GHSA-p2qg-cv6r-5429, MGASA-2021-0081, OESA-2021-1037, SUSE-SU-2021:1029-1 and 2 more.