PT-2020-20367 · Openthread · Wpantund

Published 2020-07-07 · Updated 2020-07-16 · CVE-2020-8916

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7

Description A memory leak in Openthread's wpantund can allow an attacker to crash the service, resulting in a denial of service (DoS), particularly in environments where wpanctl directly interfaces with the control driver, such as debug environments.

Recommendations For Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, update to a newer version to resolve the issue. As a temporary workaround, consider restricting access in debug environments to minimize the risk of exploitation.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2020-8916

Affected Products

Wpantund

References · 4

• https://github.com/openthread/wpantund/pull/468/commits/0e5d1601febb869f583e944785e5685c6c747be7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-8916 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8916 · Vendor Advisory
• https://t.me/cvenotify/4947 · Telegram Post