#VU59116 Out-of-bounds write in uIP and Contiki OS - CVE-2020-17438
Published: December 29, 2021
Vulnerability identifier: #VU59116
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Red
CVE-ID: CVE-2020-17438
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
uIP
Contiki OS
uIP
Contiki OS
Software vendor:
Adam Dunkels
contiki-os.org
Adam Dunkels
contiki-os.org
Description
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing IP packets. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. A remote attacker can send specially crafted IP packets to the system, trigger an out-of-bounds write and execute arbitrary code on the target system.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.