PT-2020-3137 · Semtech · Lora Basics Station
Gbartnik
·
Published
2020-06-17
·
Updated
2020-07-01
·
CVE-2020-4060
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
LoRa Basics Station versions prior to 2.0.4
Description
The issue is related to a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message where the signature length is larger than 2 GByte or the response is crafted specifically to trigger this issue. In such a scenario, Basic Station would execute a code path, where a piece of memory is accessed after it has been freed, causing the process to crash and restart again. The CUPS transaction is typically mutually authenticated over TLS. Therefore, in order to trigger this vulnerability, the attacker would have to gain access to the CUPS server first.
Recommendations
For versions prior to 2.0.4, update to version 2.0.4 to fix the issue. As a temporary workaround for users operating without authentication over TLS, enable TLS authentication to minimize the risk of exploitation. Restrict access to the CUPS server to prevent unauthorized access and potential triggering of the vulnerability.
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lora Basics Station