CVE-2020-6070: An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12

This month

HIGH 7.8DOWNGRADEMITIGATE

CVE-2020-6070 is a high-severity flaw (CVSS 7.8) affecting f2fs-tools, fedora. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a logic flaw and out-of-bounds heap operations, resulting in code execution. An attacker can provide a malicious file to trigger this vulnerability.

Why this priority

High severity
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	1.7% (top 22%)
CISA exploited list	No
Weakness	CWE-131
Published	2020-08-10
Last modified	2026-06-17

Publisher (CNA): Talos · Vendor: f2fs-tools project · fedoraproject

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-08-10 14:15 UTCPublished CVE record published
2026-06-17 03:22 UTCUpdated Record last modified

f2fs-tools project f2fs-tools DOWNGRADE

Affected: 1.12.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.12.0

1. Check installed version

apt-cache policy f2fs-tools || rpm -q f2fs-tools || f2fs-tools --version

2. No fixed release: DOWNGRADE to a release before 1.12.0 (Debian / Ubuntu)

apt-cache madison f2fs-tools sudo apt install f2fs-tools=<VERSION_BEFORE_1.12.0> sudo apt-mark hold f2fs-tools

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list f2fs-tools sudo dnf downgrade f2fs-tools-<VERSION_BEFORE_1.12.0> sudo dnf versionlock add f2fs-tools

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

fedoraproject fedora MITIGATE

Affected: 33

Fixed in: no fixed release known

Safe to downgrade to: a release before 33

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-6070?

f2fs-tools: downgrade or apply the listed mitigation; fedora: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-6070 being exploited?

CVE-2020-6070 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-6070 affect?

CVE-2020-6070 affects f2fs-tools, fedora. Severity is high (CVSS 7.8). An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a logic flaw and out-of-bounds heap operations, resulting in code execution. An attack

How urgent is CVE-2020-6070?

Priority 52/100. High severity; Public exploit reference

Related CVEs

CVE-2020-6108 HIGH 7.8 UPGRADE An exploitable code execution vulnerability exists in the fsck_chk_orphan_node functionality of F2fs-Tools F2f
CVE-2020-6107 MEDIUM 5.5 UPGRADE An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fs
CVE-2020-6106 MEDIUM 5.5 UPGRADE An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tool
CVE-2020-6105 HIGH 7.8 UPGRADE An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fs
CVE-2020-6104 MEDIUM 5.5 UPGRADE An exploitable information disclosure vulnerability exists in the get_dnode_of_data functionality of F2fs-Tool

References

← Back to latest CVEs