PT-2021-11591 · Wind River · Vxworks

Published 2021-02-03 · Updated 2022-05-12 · CVE-2020-28895

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Wind River VxWorks (affected versions not specified)

Description: The issue is related to a possible overflow in the memory allocator when calculating the size of the memory block to be allocated by calloc(). This results in the actual memory allocated being smaller than the buffer size specified by the arguments, leading to memory corruption.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

CVE-2020-28895

Affected Products

Vxworks

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-28895 · Security Note
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-28895 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/CVE-2020-28895 · Vendor Advisory
• https://t.me/cvenotify/9344 · Telegram Post
• https://t.me/cvenotify/9357 · Telegram Post
• https://support2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327 · Note