Log in Start free

Vulnerability · Published May 11, 2020 · Assigned by zephyr

CVE-2020-10060UpdateHub Might Dereference An Uninitialized Pointer

High 8.0

In plain English

A high-severity memory corruption in zephyr from zephyrproject-rtos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High
Exploit odds (30 days)1.6%top 24.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.

Affected products (as reported)

VendorProductVersions
zephyrproject-rtos zephyr 2.1.0 – before unspecified2.2.0 – before unspecified

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References