PT-2018-17575 · Ccn-Lite · Ccn-Lite

Mfrey + 1 · Published 2018-01-31 · Updated 2018-02-21 · CVE-2018-6480

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CCN-lite version 2

Description A type confusion issue was discovered, leading to a memory access violation and a failure of the nonce feature, which is used for loop prevention. The ccnl fwd handleInterest function assumes a specific type for the union member s, but if the type is different, the memory is either uninitialised or points to incorrect data, rendering the nonce check insufficient.

Recommendations For CCN-lite version 2, consider modifying the ccnl fwd handleInterest function to correctly handle different types for the union member s, ensuring that the memory access is valid and the nonce feature functions as intended.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2018-6480

Affected Products

Ccn-Lite

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-6480 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6480 · Vendor Advisory
• https://github.com/cn-uofbasel/ccn-lite/issues/159 · Note