CVE-2020-26164 Denial of service in n/a
A remote attacker on the local network can cause a denial of service in KDE Connect by sending crafted packets that exhaust system resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26164?
CVE-2020-26164 is a medium-severity denial of service vulnerability in Opensuse Backports Sle, published on 7 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Weakness: CWE-400
Which versions are affected by CVE-2020-26164?
It affects 3 products.
Linux distribution packages (4)
kdeconnect-kde SUSE:Package Hub 15 SP1 | All versions | 1.3.3-bp151.4.3.1 |
kdeconnect-kde SUSE:Package Hub 15 SP2 | All versions | 20.04.2-bp152.2.3.1 |
kdeconnect-kde openSUSE:Leap 15.1 | All versions | 20.04.2-lp152.2.3.1 |
kdeconnect-kde openSUSE:Leap 15.2 | All versions | 20.04.2-lp152.2.3.1 |
Products include Kde Kdeconnect, Opensuse Backports Sle, Opensuse Leap.
How do I fix CVE-2020-26164?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-26164 being exploited?
There is no known exploitation of CVE-2020-26164 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-26164, GHSA-6f3v-3c9w-7rq7, MGASA-2020-0416, UBUNTU-CVE-2020-26164, openSUSE-SU-2020:1631-1, openSUSE-SU-2020:1647-1 and 2 more.