CVE-2020-27350

What it actually does

Integer overflows and underflows during .deb package parsing in apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc result in memory corruption.

Why it matters to the business

Local attackers with administrative access on package-managed systems can trigger memory corruption that may lead to limited code execution or denial of service, affecting software installation and update processes across Debian, Ubuntu, and derivative deployments.

How an attack unfolds

An attacker with local administrative privileges supplies a specially crafted .deb archive that triggers the integer arithmetic errors during extraction or header processing, causing out-of-bounds memory access.

How to fix it

Upgrade apt to the fixed Ubuntu releases 1.2.32ubuntu0.2, 1.6.12ubuntu0.2, 2.0.2ubuntu0.2, or 2.1.10ubuntu0.1 (or later) on affected distributions; rebuild or replace packages on Debian-based systems once corrected builds are available.

How to confirm the fix worked

Confirm apt binary and library versions match or exceed the listed fixed releases; run package parsing tests against known-good and malformed .deb files; verify no crashes or incorrect memory handling occur.

Typical attack path

1. Obtain local administrative access on a target system using apt
2. Craft a malicious .deb package containing malformed archive headers or tar entries
3. Invoke apt or dpkg operations that parse the package
4. Trigger integer overflow/underflow leading to memory corruption

How to detect it

Review system logs for unexpected apt or dpkg crashes during package operations; inspect process core dumps or sanitizer reports indicating arithmetic errors in apt-pkg libraries.

What your security team should do

• Prioritize patching apt on all internet-facing or multi-tenant systems within the next maintenance window
• Restrict local administrative access to package management tools where feasible
• Monitor vendor advisories for Debian and Ubuntu for backported fixes