PT-2020-15686 · Contiki · Contiki-Ng+2

Published 2020-12-11 · Updated 2020-12-15 · CVE-2020-24334

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions uIP versions 1.0 and earlier Contiki versions prior to the fix Contiki-NG versions prior to the fix

Description The issue arises from the code that processes DNS responses in uIP, which does not verify if the number of responses in the DNS packet header matches the available response data. This leads to an out-of-bounds read and results in a Denial-of-Service in the resolv.c file.

Recommendations For uIP versions 1.0 and earlier, update to a version that includes the fix for the DNS response processing issue. For Contiki and Contiki-NG, apply the necessary patches or updates to resolve the out-of-bounds read issue in the resolv.c file. As a temporary workaround, consider restricting DNS response processing until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2020-24334

Affected Products

Contiki

Contiki-Ng

Uip

References · 5

• https://osv.dev/vulnerability/CVE-2020-24334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24334 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 · Note
• https://kb.cert.org/vuls/id/815128 · Note
• https://t.me/cvenotify/7055 · Telegram Post