CVE-2018-20340

CVE-2018-20340 describes a buffer overflow vulnerability in Yubico libu2f-host versions prior to 1.1.6, specifically within the devs.c file due to unchecked buffers. This flaw primarily affects Debian systems utilizing the vulnerable libu2f-host library. An attacker could leverage this by presenting a specially crafted, malicious USB device masquerading as a security token, potentially leading to arbitrary code execution on the host system. The vulnerability carries a CVSS score of 6.8 (Medium), indicating a physical attack vector with low complexity, requiring no user interaction, and potentially resulting in high impact to confidentiality, integrity, and availability. It is important to note that genuine YubiKeys cannot be used to perform this attack. Currently, there is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness or concern.