PT-2021-6541 · Lwip · Lwip

Silentdawn + 1 · Published 2021-07-22 · Updated 2021-07-29 · CVE-2020-22284

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions lwIP versions 2.1.2 and git head version

Description A buffer overflow vulnerability in the zepif linkoutput() function allows attackers to access sensitive information via a crafted 6LoWPAN packet. The issue is related to the lack of input validation during buffer copying, enabling a remote attacker to exploit the vulnerability and gain access to confidential data.

Recommendations For lwIP version 2.1.2, consider disabling the zepif linkoutput() function until a patch is available. For lwIP git head version, consider disabling the zepif linkoutput() function until a patch is available. As a temporary workaround, restrict the use of crafted 6LoWPAN packets to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-01802

CVE-2020-22284

Affected Products

Lwip

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2020-22284 · Security Note
• https://savannah.nongnu.org/bugs/index.php?58554 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-22284 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-22284 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01802 · Security Note
• https://osv.dev/vulnerability/CVE-2020-22284 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-22284 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-22284 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22284 · Vendor Advisory
• https://t.me/cibsecurity/26426 · Telegram Post
• https://t.me/cvenotify/18274 · Telegram Post
• https://git.savannah.nongnu.org/cgit/lwip.git/commit/?id=8363c24e45a32728e385cfc2c3c36d88a8a9e70b · Note