CVE-2017-20283: Medium severity NXP MQX Classic vulnerability
NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation. Improper enforcement of the application-supplied receive buffer length may allow a crafted UDP packet to overflow the destination buffer, resulting in memory corruption, or denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using NXP MQX Classic versions before 5.0 are affected where the RTCS UDP recvfrom() implementation processes UDP traffic.
What does an attacker need to exploit the vulnerability?
An attacker can send a crafted UDP packet remotely. The supplied vector indicates no authentication, privileges, or user interaction are required.
What is the likely impact of successful exploitation?
A crafted packet can overflow the application destination buffer because the application-provided receive buffer length is not properly enforced. This can cause memory corruption or denial of service, with impacts to integrity and availability.
What should be prioritized for remediation?
Upgrade NXP MQX Classic to version 5.0 or later, since versions before 5.0 are identified as affected. Prioritize systems that expose RTCS UDP services to untrusted networks.