Vulnerability · Published Jan 6, 2021 · Assigned by hackerone

CVE-2020-8265

High 8.1

In plain English

A high-severity use-after-free in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.1% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.1High

Exploit odds (30 days)9.1%top 4.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2047+b07ac28e	ALSA-2021:0548
AlmaLinux:8	nodejs-nodemon	2.0.3-1.module_el8.4.0+2521+c668cc9f	ALSA-2021:0551
AlmaLinux:8	nodejs-nodemon	2.0.3-1.module_el8.4.0+2521+c668cc9f	ALSA-2021:0549
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2023+d2377ea3	ALSA-2021:0548
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2021:0549
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2021:0549
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2021:0549
AlmaLinux:8	nodejs-packaging	23-3.module_el8.5.0+254+b4526b16	ALSA-2021:0551
AlmaLinux:8	nodejs-packaging	23-3.module_el8.4.0+2522+3bd42762	ALSA-2021:0551
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2021:0548
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2021:0548
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2021:0548
Alpine:v3.20	nodejs	14.15.4-r0	ALPINE-CVE-2020-8265
Alpine:v3.21	nodejs	14.15.4-r0	ALPINE-CVE-2020-8265
Alpine:v3.22	nodejs	14.15.4-r0	ALPINE-CVE-2020-8265
Alpine:v3.23	nodejs	14.15.4-r0	ALPINE-CVE-2020-8265
Alpine:v3.24	nodejs	14.15.4-r0	ALPINE-CVE-2020-8265
Alpine:v3.20	nodejs-current	15.5.1-r0	ALPINE-CVE-2020-8265
Alpine:v3.21	nodejs-current	15.5.1-r0	ALPINE-CVE-2020-8265
Alpine:v3.22	nodejs-current	15.5.1-r0	ALPINE-CVE-2020-8265
Alpine:v3.23	nodejs-current	15.5.1-r0	ALPINE-CVE-2020-8265
Alpine:v3.24	nodejs-current	15.5.1-r0	ALPINE-CVE-2020-8265
Debian:12	nodejs	12.20.1~dfsg-1	DEBIAN-CVE-2020-8265
Debian:13	nodejs	12.20.1~dfsg-1	DEBIAN-CVE-2020-8265
Debian:14	nodejs	12.20.1~dfsg-1	DEBIAN-CVE-2020-8265
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.4.0+638+5344c6f7	RLSA-2021:0549
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.3.0+100+234774f7	RLSA-2021:0549
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.6.0+982+9fdca2d4	RLSA-2021:0549
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.3.0+100+234774f7	RLSA-2021:0551
Rocky Linux:8	nodejs-nodemon	0:1.18.3-1.module+el8.3.0+101+f84c7154	RLSA-2021:0548
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.6.0+982+9fdca2d4	RLSA-2021:0551
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.4.0+638+5344c6f7	RLSA-2021:0551
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2021:0549
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.3.0+100+234774f7	RLSA-2021:0551
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.7.0+1071+4bdda2a8	RLSA-2021:0551
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.5.0+733+de4fee6c	RLSA-2021:0551
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2021:0548

Affected products (as reported)

Vendor	Product	Versions
NodeJS	Node	4.0 – before 4.5.0 – before 5.6.0 – before 6.7.0 – before 7.8.0 – before 8.9.0 – before 9.10.0 – before 10.23.111.0 – before 11.*

Weakness: CWE-416

References

https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ x_refsource_MISC
https://hackerone.com/reports/988103 x_refsource_MISC
DSA-4826 vendor-advisory, x_refsource_DEBIAN
FEDORA-2021-fb1a136393 vendor-advisory, x_refsource_FEDORA
GLSA-202101-07 vendor-advisory, x_refsource_GENTOO
FEDORA-2021-d5b2c18fe6 vendor-advisory, x_refsource_FEDORA
https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210212-0003/ x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf x_refsource_CONFIRM