CVE-2020-10071: zephyrproject-rtos zephyr, грешка в паметта

Описание

Оригинално описание

The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

Засегнати продукти

• zephyrproject-rtos zephyr: 2.2.0 преди unspecified

Вид слабост

• CWE-120 Копиране в буфер без проверка на размера на входа
• CWE-129 Неправилна валидация на индекс на масив

История

Други уязвимости в zephyrproject-rtos zephyr

• 7.5CVE-2026-13351
• 7.6CVE-2026-5068
• 9.8CVE-2026-5067
• 6.3CVE-2026-5066
• 6.3CVE-2026-5589

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2020-10071
• https://nvd.nist.gov/vuln/detail/CVE-2020-10071
• https://research.nccgroup.com/2020/05/26/research-report-zephyr-and-mcuboot-security-assessment
• https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-86
• https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10071
• https://github.com/zephyrproject-rtos/zephyr/pull/23821/commits/989c4713ba429aa5105fe476b4d629718f3e6082