PT-2019-14334 · Riot · Riot

Nmeumo · Published 2019-08-27 · Updated 2020-02-18 · CVE-2019-15702

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RIOT through 2019.07

Description The issue is related to the TCP implementation in RIOT, where the parser for TCP options does not properly terminate on all inputs. This can lead to a denial-of-service due to an infinite loop when encountering an unknown zero-length option in the sys/net/gnrc/transport layer/tcp/gnrc tcp option.c file.

Recommendations For RIOT through 2019.07, consider applying a patch to fix the infinite loop issue in the TCP options parser to prevent denial-of-service attacks.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2019-15702

Affected Products

Riot

References · 3

• 🔥 https://github.com/RIOT-OS/RIOT/issues/12086 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15702 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15702 · Vendor Advisory