CVE-2020-24336

Katalog CVE

CVSS 9.8 · Critical EPSS 59,1%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada contiki-ng, contiki-os contiki. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. Therefore, when copying an address of an arbitrary length, a buffer overflow can occur. This bug can be exploited whenever NAT64 is enabled.

Rincian

Terbit di NVD

11 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

59,1% peluang dieksploitasi; lebih tinggi dari 99,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 advisory pihak ketiga · pemerintah AS
• https://www.kb.cert.org/vuls/id/815128 advisory pihak ketiga · pemerintah AS