CVE-2018-20340

Published: 08 February 2019

Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.

Priority

Medium

CVSS 3 base score: 6.8

Status

Package Release Status
libu2f-host
Launchpad, Ubuntu, Debian
Upstream Pending
(1.1.7)
Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(1.1.7-1)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(1.1.7-1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (1.1.4-1ubuntu0.1)
Ubuntu 16.04 LTS (Xenial Xerus) Needed

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Patches:
Upstream: https://github.com/Yubico/libu2f-host/commit/4d490bb2c528c351e32837fcdaebd998eb5d3f27
Binaries built from this source package are in Universe and so are supported by the community.

Notes

AuthorNote
sbeattie requires libpam-u2f setup or other yubikey based software applications. Browser U2F implmentations are NOT affected.

References

Bugs