Vulnerability · Published Jun 5, 2020 · Assigned by zephyr
CVE-2020-10071Insufficient publish message length validation in MQTT
Critical 9.0
In plain English
A critical-severity buffer overflow in zephyr from zephyrproject-rtos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities).
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)3.4%top 11.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zephyrproject-rtos | zephyr | 2.2.0 – before unspecified |
Weakness: CWE-120, CWE-129 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://research.nccgroup.com/2020/05/26/research-report-zephyr-and-mcuboot-security-assessment x_refsource_MISC
- https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-86 x_refsource_MISC
- https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10071 x_refsource_MISC
- https://github.com/zephyrproject-rtos/zephyr/pull/23821/commits/989c4713ba429aa5105fe476b4d629718f3e6082 x_refsource_MISC