CVE-2018-1000800: Null Pointer Dereference

Published Sep 6, 2018

Updated

zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sysringbufput(), sysringbufget() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs (system sysringbufget() and sysringbufput).

Affected Software

1 affected component

zephyrproject zephyr=1.12.0

Event History

Sep 6, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-1000800?

CVE-2018-1000800 is considered to have a medium severity due to the potential for a CPU Page Fault from a NULL pointer dereference.

How do I fix CVE-2018-1000800?

To fix CVE-2018-1000800, update to a patched version of Zephyr RTOS that resolves the NULL pointer reference in sys_ring_buf_put() and sys_ring_buf_get().

What versions of Zephyr RTOS are affected by CVE-2018-1000800?

CVE-2018-1000800 affects Zephyr RTOS version 1.12.0.

Can CVE-2018-1000800 be exploited remotely?

CVE-2018-1000800 requires a malicious application call to the vulnerable kernel APIs, making it dependent on local exploitation.

What are the potential consequences of exploiting CVE-2018-1000800?

Exploitation of CVE-2018-1000800 can result in a CPU Page Fault, which may lead to system instability or crashes.