SB2020051283 - Multiple vulnerabilities in rutantan zephyr

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020051283

SB2020051283 - Multiple vulnerabilities in rutantan zephyr

Published: May 12, 2020 Updated: August 8, 2020

Security Bulletin ID SB2020051283
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2020-10022)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.


2) Improper Certificate Validation (CVE-ID: CVE-2020-10059)

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions.


3) Buffer overflow (CVE-ID: CVE-2020-10060)

The vulnerability allows a remote privileged user to #BASIC_IMPACT#.

In updatehub_probe, right after JSON parsing is complete, objects[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Recommend disabling updatehub until such a time as a fix can be made available. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.


Remediation

Install update from vendor's website.

References