CVE-2020-10027

Technical details about CVE-2020-10027 are not publicly available in the provided connected documents; monitor for updates.

CVE-2020-10023 Shell Subsystem Contains a Buffer Overflow Vulnerability In shell_spaces_trim

The shell subsystem contains a buffer overflow, whereby an adversary with physical access to the device is able to cause a memory corruption, resulting in denial of service or possibly code execution within the Zephyr kernel. See NCC-NCC-019 This issue affects: zephyrproject-rtos zephyr version...

CVE-2020-10024 ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 a...

CVE-2020-10023

The shell subsystem contains a buffer overflow, whereby an adversary with physical access to the device is able to cause a memory corruption, resulting in denial of service or possibly code execution within the Zephyr kernel. See NCC-NCC-019 This issue affects: zephyrproject-rtos zephyr version...

CVE-2020-10024

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 a...

CVE-2020-10024

This CVE concerns Zephyr RTOS: the ARM platform-specific code uses a signed integer comparison when validating syscall numbers. The root cause enables privilege escalation from a user thread to kernel level if code execution is obtained in user space. Affected versions are Zephyr project-rtos Zep...

CVE-2020-10022 UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later...

CVE-2020-10022

CVE-2020-10022 affects Zephyr OS (zephyrproject-rtos) via a malformed JSON payload received from an UpdateHub server, causing memory corruption. This leads to either denial of service or potential code execution in Zephyr versions 2.1.0 and later (including 2.2.0+). Root cause described across co...

CVE-2020-10019 Buffer Overflow in USB DFU requested length

USB DFU has a potential buffer overflow where the requested length wLength is not checked against the buffer size. This could be used by a malicious USB host to exploit the buffer overflow. See NCC-ZEP-002 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version...

CVE-2020-10021 Out-of-bounds write in USB Mass Storage with unaligned sizes

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions...

CVE-2020-10021

CVE-2020-10021 is an active vulnerability describing an out-of-bounds write in the USB Mass Storage memoryWrite handler caused by unaligned sizes. Affected: Zephyr RTOS, Zephyr 1.14.1 and later, and 2.1.0 and later. CVSS data indicate a high-severity, local-attack scenario with potential confiden...

CVE-2020-10019

CVE-2020-10019 describes a buffer overflow in Zephyr’s USB DFU path. The flaw occurs when the requested length (wLength) is not validated against the destination buffer size, enabling exploitation by a USB host. Affected products are Zephyr RTOS releases 1.14.1 and later, and 2.1.0 and later. The...

CVE-2020-10021

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions...

CVE-2020-10019

USB DFU has a potential buffer overflow where the requested length wLength is not checked against the buffer size. This could be used by a malicious USB host to exploit the buffer overflow. See NCC-ZEP-002 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version...

CVE-2020-10059: Improper Certificate Validation

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr versi...

PT-2020-11864

Name of the Vulnerable Software and Affected Versions zephyr versions 1.14.1 through 2.1.0 and later versions. Description The issue is related to an out-of-bounds write in the USB Mass Storage memoryWrite handler with unaligned sizes. This affects the zephyrproject-rtos. Recommendations For...

PT-2020-11865

Name of the Vulnerable Software and Affected Versions zephyrproject-rtos zephyr versions 2.1.0 through 2.2.0 and later versions. Description A malformed JSON payload received from an UpdateHub server may cause memory corruption in the Zephyr OS, potentially leading to a denial of service or code...

PT-2020-11871

Name of the Vulnerable Software and Affected Versions zephyr versions 1.14.0 and later zephyr versions 2.1.0 and later Description The issue is related to multiple syscalls with insufficient argument validation. This problem affects the zephyrproject-rtos. Recommendations For zephyr version 1.14....

CVE-2020-10067: Integer Overflow or Wraparound

A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption resulting in code execution within the...

CVE-2020-10060: Improper Restriction of Operations within the Bounds of a Memory Buffer

In updatehubprobe, right after JSON parsing is complete, objects\1 is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an...