Multiple vulnerabilities in rutantan zephyr



| Updated: 2020-08-09
Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2020-10061
CVE-2020-10068
CVE-2020-10021
CWE-ID CWE-119
CWE-20
CWE-787
Exploitation vector Local network
Public exploit N/A
Vulnerable software
 zephyr
Other software / Other software solutions

Vendor rutantan

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU41109

Risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-10061

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

zephyr: 2.1.0

CPE2.3 External links

https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10061
https://github.com/zephyrproject-rtos/zephyr/pull/23091
https://github.com/zephyrproject-rtos/zephyr/pull/23516
https://github.com/zephyrproject-rtos/zephyr/pull/23517
https://github.com/zephyrproject-rtos/zephyr/pull/23547
https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-75


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU41110

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-10068

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resulting in a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

zephyr: 2.1.0

CPE2.3 External links

https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10068
https://github.com/zephyrproject-rtos/zephyr/pull/23091
https://github.com/zephyrproject-rtos/zephyr/pull/23707
https://github.com/zephyrproject-rtos/zephyr/pull/23708
https://github.com/zephyrproject-rtos/zephyr/pull/23964
https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-78


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU41112

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-10021

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

zephyr: 2.1.0

CPE2.3 External links

https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10021
https://github.com/zephyrproject-rtos/zephyr/pull/23240
https://github.com/zephyrproject-rtos/zephyr/pull/23455
https://github.com/zephyrproject-rtos/zephyr/pull/23456
https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-26


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###