PT-2020-11892 · Zephyr · Zephyr

Published 2020-06-05 · Updated 2020-06-12 · CVE-2020-10062

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions zephyr version 2.2.0 and later versions

Description An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution.

Recommendations For zephyr version 2.2.0 and later versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2020-10062

Affected Products

Zephyr

References · 6

• https://github.com/zephyrproject-rtos/zephyr/pull/23821/commits/11b7a37d9a0b438270421b224221d91929843de4 · Patch
• https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10062 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10062 · Vendor Advisory
• https://research.nccgroup.com/2020/05/26/research-report-zephyr-and-mcuboot-security-assessment · Note
• https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-84 · Note