CVE-2020-10022 UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later...

CVE-2020-10021

CVE-2020-10021 is an active vulnerability describing an out-of-bounds write in the USB Mass Storage memoryWrite handler caused by unaligned sizes. Affected: Zephyr RTOS, Zephyr 1.14.1 and later, and 2.1.0 and later. CVSS data indicate a high-severity, local-attack scenario with potential confiden...

CVE-2020-10019 Buffer Overflow in USB DFU requested length

USB DFU has a potential buffer overflow where the requested length wLength is not checked against the buffer size. This could be used by a malicious USB host to exploit the buffer overflow. See NCC-ZEP-002 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version...

CVE-2020-10021 Out-of-bounds write in USB Mass Storage with unaligned sizes

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions...

CVE-2020-10019

CVE-2020-10019 describes a buffer overflow in Zephyr’s USB DFU path. The flaw occurs when the requested length (wLength) is not validated against the destination buffer size, enabling exploitation by a USB host. Affected products are Zephyr RTOS releases 1.14.1 and later, and 2.1.0 and later. The...