Local System Vulnerability in NGINX Controller by F5 Networks

CVE-2020-5895

Summary

The NGINX Controller, specifically in versions 3.1.0 to 3.3.0, contains a vulnerability due to AVRD using inadequate permissions on its socket. This flaw exposes the socket to world-readable and world-writable access, enabling malicious processes or users on the local system to inject arbitrary data. Such an attack can lead to instability in the AVRD, causing segmentation faults and potential disruption of services.

References