CVE-2020-13603

CVE-2020-13603 affects Zephyr Project RTOS: memory-allocation integer overflow in Zephyr’s allocator. Affected versions: Zephyr 1.14.2 and newer (including 2.4.0 and beyond). Root cause is an integer overflow/wraparound in memory allocating functions, leading to potential memory corruption. Publi...

CVE-2020-13603 Integer Overflow in memory allocating functions

Integer Overflow in memory allocating functions. Zephyr versions = 1.14.2, = 2.4.0 contain Integer Overflow or Wraparound CWE-190. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-94vp-8gc2-rm45...

CVE-2020-13602

CVE-2020-13602 describes a Remote Denial of Service in Zephyr’s LwM2M do_write_op_tlv. Affected product: Zephyr RTOS, with vulnerable branches at least v1.14.2 and v2.2.0. Root cause: improper input validation (CWE-20) leading to an Infinite Loop (CWE-835). Impact: Denial of service due to proces...

CVE-2020-13602 Remote Denial of Service in LwM2M do_write_op_tlv

Remote Denial of Service in LwM2M dowriteoptlv. Zephyr versions = 1.14.2, = 2.2.0 contain Improper Input Validation CWE-20, Loop with Unreachable Exit Condition 'Infinite Loop' CWE-835. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-g9mg-fj58-6fqh...

CVE-2020-13601 Possible read out of bounds in dns read

Possible read out of bounds in dns read. Zephyr versions = 1.14.2, = 2.3.0 contain Out-of-bounds Read CWE-125. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44...

CVE-2020-13600 Malformed SPI in response for eswifi can corrupt kernel memory

Malformed SPI in response for eswifi can corrupt kernel memory. Zephyr versions = 1.14.2, = 2.3.0 contain Heap-based Buffer Overflow CWE-122. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hx4p-j86p-2mhr...

CVE-2020-13600

CVE-2020-13600 concerns Zephyr RTOS where a malformed SPI response for eswifi can corrupt kernel memory. Affected are Zephyr versions >= 1.14.2 and >= 2.3.0, where heap-based buffer overflow (CWE-122) is reported as the underlying issue. The vulnerability can lead to kernel memory corruptio...

CVE-2020-13601

CVE-2020-13601 affects Zephyr RTOS, with an Out-of-bounds Read (CWE-125) in the DNS read path reported for Zephyr versions >= 1.14.2 and >= 2.3.0. The public entries indicate a network-based issue with potential for high impact (CVSS v3.1: CRITICAL, 9.8; CVSS v2: 7.5) and a high-severity co...

CVE-2020-13599 Security problem with settings and littlefs

Security problem with settings and littlefs. Zephyr versions = 1.14.2, = 2.3.0 contain Incorrect Default Permissions CWE-276. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5qhg-j6wc-4f6q...

CVE-2020-13599

CVE-2020-13599 concerns a security problem with Zephyr’s settings handling when used with littlefs, where Zephyr versions >= 1.14.2 and >= 2.3.0 are affected by incorrect default permissions (CWE-276). The available connected sources corroborate the issue and link to the GHSA advisory GHSA-...

CVE-2020-13598 FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat

FS: Buffer Overflow when enabling Long File Names in FATFS and calling fsstat. Zephyr versions = v1.14.2, = v2.3.0 contain Stack-based Buffer Overflow CWE-121. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7fhv-rgxr-x56h...

CVE-2020-10072 Improper Handling of Insufficient Permissions or Privileges in zephyr

Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Insufficient Permissions or Privileges CWE-280. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf79-hqwm-w4xc...

CVE-2020-13598

CVE-2020-13598 describes a stack-based buffer overflow in Zephyr RTOS related to enabling Long File Names in FAT_FS when calling fs_stat. Affected: Zephyr versions >= v1.14.2 and >= v2.3.0. Root cause: buffer overflow in the Long File Names handling logic. Potential impact: according to con...

CVE-2020-10072

CVE-2020-10072 concerns Zephyr RTOS with an improper handling of insufficient permissions or privileges (CWE-280). Affected releases are Zephyr versions >= v1.14.2 and >= v2.2.0. The vulnerability is rooted in how privileges are managed within the Zephyr kernel/OS, potentially impacting con...

CVE-2020-10069 Zephyr Bluetooth unchecked packet data results in denial of service

Zephyr Bluetooth unchecked packet data results in denial of service. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Parameters CWE-233. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-f6vh-7v4x-8fjp...

CVE-2020-10069

CVE-2020-10069 affects Zephyr RTOS Bluetooth stack. The vulnerability allows denial of service due to unchecked packet data related to improper handling of parameters (CWE-233) in Zephyr versions v1.14.2 and newer (including v2.2.0+). The description in connected sources confirms the issue is roo...

CVE-2020-10065 Missing Size Checks in Bluetooth HCI over SPI

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

CVE-2020-10066 Incorrect Error Handling in Bluetooth HCI core

Incorrect Error Handling in Bluetooth HCI core. Zephyr versions = v1.14.2, = v2.2.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr...

CVE-2020-10065

CVE-2020-10065 affects Zephyr’s Bluetooth HCI over SPI. The issue is missing size checks due to improper handling of the length parameter (CWE-130) in Zephyr versions >= v1.14.2 and >= v2.2.0. The advisories reference GHSA-hg2w-62p6-g67c; no patch/affected patch version is provided in the s...

CVE-2020-10066

CVE-2020-10066 concerns a NULL pointer dereference in the Bluetooth HCI core of Zephyr RTOS. Affected products are Zephyr versions >= v1.14.2 and >= v2.2.0; the underlying cause is an error-handling defect (CWE-476) in the Bluetooth HCI subsystem. The Connected documents do not provide a co...