PT-2020-15034 · Apache · Apache Nuttx

Published 2020-12-09 · Updated 2020-12-16 · CVE-2020-17529

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NuttX (incubating) versions up to and including 10.0.0

Description The issue is an Out-of-bounds Write vulnerability in the TCP Stack, allowing an attacker to corrupt memory by supplying an invalid fragmentation offset value specified in the IP header. This vulnerability only impacts builds with both CONFIG EXPERIMENTAL and CONFIG NET TCP REASSEMBLY build flags enabled.

Recommendations For Apache NuttX (incubating) versions up to and including 10.0.0, consider disabling the TCP reassembly functionality by disabling the CONFIG NET TCP REASSEMBLY build flag as a temporary workaround until a patch is available. Restrict access to the TCP stack to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-17529

Affected Products

Apache Nuttx

References · 14

• https://lists.apache.org/thread.html/r4d71ae3ab96b589835b94ba7ac4cb88a704e7307bceefeab749366f3%40%3Cdev.nuttx.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17529 · Security Note
• https://t.me/cibsecurity/18030 · Telegram Post
• https://t.me/cvenotify/6870 · Telegram Post
• http://openwall.com/lists/oss-security/2020/12/09/5 · Note
• https://t.me/cibsecurity/18068 · Telegram Post
• https://t.me/cibsecurity/18107 · Telegram Post
• https://t.me/cibsecurity/18049 · Telegram Post
• https://t.me/cvenotify/6860 · Telegram Post
• https://t.me/cibsecurity/18011 · Telegram Post
• https://t.me/cibsecurity/18127 · Telegram Post
• https://t.me/cibsecurity/18088 · Telegram Post
• https://t.me/cibsecurity/17991 · Telegram Post