CVE-2020-17437

Katalog CVE

CVSS 8.2 · High EPSS 2,8%

Kerentanan Out-of-bounds Write pada uip project uip, open-iscsi project open-iscsi +9 lainnya. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.

Rincian

Terbit di NVD

11 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

2,8% peluang dieksploitasi; lebih tinggi dari 86,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf patch · advisory pihak ketiga
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 advisory pihak ketiga · pemerintah AS
• https://www.kb.cert.org/vuls/id/815128 advisory pihak ketiga · pemerintah AS