PT-2020-15692 · Altran · Picotcp-Ng+1

Published 2020-12-11 · Updated 2020-12-14 · CVE-2020-24341

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions picoTCP and picoTCP-NG versions through 1.7.0

Description The issue arises from the TCP input data processing function in pico tcp.c, which fails to validate the length of incoming TCP packets. This leads to an out-of-bounds read when assembling received packets into a data segment. As a result, it can cause Denial-of-Service or an information leak.

Recommendations For picoTCP and picoTCP-NG versions through 1.7.0, consider updating to a version that includes a fix for the TCP input data processing function in pico tcp.c to validate the length of incoming TCP packets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2020-24341

Affected Products

Picotcp

Picotcp-Ng

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-24341 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24341 · Vendor Advisory
• https://t.me/cvenotify/7063 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 · Note
• https://kb.cert.org/vuls/id/815128 · Note