CVE-2020-28018: Exim Use After Free Vulnerability

CVE-2020-28018 Overview

CVE-2020-28018 is a critical Use After Free vulnerability affecting Exim mail transfer agent versions prior to 4.94.2. The vulnerability exists in the smtp_reset function and is particularly prevalent in builds compiled with OpenSSL. This memory corruption flaw allows remote attackers to potentially execute arbitrary code or cause denial of service conditions on vulnerable mail servers.

Critical Impact

This Use After Free vulnerability in Exim's SMTP handling can be exploited remotely without authentication, potentially allowing attackers to compromise mail servers and gain unauthorized access to sensitive email communications.

Affected Products

• Exim versions prior to 4.94.2
• Exim builds compiled with OpenSSL
• Systems running unpatched Exim mail transfer agents

Discovery Timeline

• 2021-05-06 - CVE-2020-28018 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-28018

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption vulnerability that occurs when a program continues to use a pointer after the memory it references has been freed. In the context of Exim, this issue manifests within the smtp_reset function, which is responsible for resetting the SMTP session state between commands or connections.

The flaw is particularly common in Exim builds compiled with OpenSSL, suggesting that the interaction between Exim's memory management and OpenSSL's buffer handling creates conditions where freed memory can be subsequently accessed. When exploited, this can lead to arbitrary code execution or application crashes.

Root Cause

The root cause of CVE-2020-28018 lies in improper memory management within Exim's smtp_reset function. When handling SMTP sessions, the function deallocates certain memory structures but fails to properly invalidate all references to that memory. In specific scenarios—particularly those involving OpenSSL operations—subsequent code paths may attempt to access this freed memory, leading to undefined behavior.

The vulnerability is exacerbated by the complexity of managing memory across the boundaries between Exim's core code and OpenSSL library calls, where different subsystems may have inconsistent views of memory allocation state.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Establishing an SMTP connection to a vulnerable Exim server
2. Sending specially crafted SMTP commands that trigger the smtp_reset function
3. Manipulating the timing and sequence of operations to cause the use-after-free condition
4. Leveraging the memory corruption to potentially execute arbitrary code or crash the service

The vulnerability can be exploited through the TLS/OpenSSL code paths, making encrypted SMTP connections a potential attack surface. For detailed technical analysis, refer to the Exim Security Analysis for CVE-2020-28018.

Detection Methods for CVE-2020-28018

Indicators of Compromise

• Unexpected Exim process crashes or restarts, particularly during SMTP TLS handshakes
• Abnormal memory usage patterns in Exim daemon processes
• Suspicious SMTP connection patterns with unusual command sequences
• Core dumps or segmentation faults in Exim logs related to smtp_reset
• Evidence of memory corruption in system logs during mail processing

Detection Strategies

• Monitor Exim version strings in logs to identify vulnerable installations (versions below 4.94.2)
• Implement network intrusion detection rules for anomalous SMTP traffic patterns
• Deploy memory safety monitoring tools to detect use-after-free conditions in running processes
• Enable enhanced Exim debugging logs to capture unusual smtp_reset behavior
• Use vulnerability scanners to identify Exim servers running affected versions

Monitoring Recommendations

• Configure centralized logging for all Exim servers to correlate potential exploitation attempts
• Set up alerts for repeated SMTP connection failures or crashes on mail servers
• Monitor for unusual TLS/SSL negotiation patterns in SMTP traffic
• Track Exim process stability metrics and restart frequency
• Review OpenSSL-related errors in conjunction with Exim service anomalies

How to Mitigate CVE-2020-28018

Immediate Actions Required

• Upgrade Exim to version 4.94.2 or later immediately
• Audit all systems for Exim installations and verify current versions
• Implement network segmentation to limit direct internet exposure of mail servers
• Consider temporary firewall rules to restrict SMTP access to trusted sources during patching
• Enable enhanced logging to detect potential exploitation attempts

Patch Information

The vulnerability is addressed in Exim version 4.94.2. Organizations should upgrade to this version or later to remediate the vulnerability. The official security advisory and technical details are available from the Exim Security Documentation. Additional discussion and context can be found in the Openwall OSS Security mailing list.

Workarounds

• If immediate patching is not possible, consider restricting SMTP access to known IP ranges using firewall rules
• Disable TLS/SSL on Exim temporarily if the attack surface can be reduced without breaking mail flow (not recommended for production)
• Implement rate limiting on SMTP connections to slow potential exploitation attempts
• Deploy a mail relay or proxy in front of vulnerable Exim servers to filter malicious traffic
• Monitor systems closely for signs of compromise while awaiting maintenance windows for patching

# Check current Exim version
exim -bV | grep version

# Example: Restrict SMTP access via iptables while patching
iptables -A INPUT -p tcp --dport 25 -s trusted_network/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP

# Verify Exim configuration after upgrade
exim -bP | grep -i version