CVE-2019-13120: High severity amazon freertos vulnerability
Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker has the authorization to send a malformed MQTT publish packet to an Amazon IoT Thing, which interacts with an associated vulnerable MQTT message in the application, specific circumstances could trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-13120?
CVE-2019-13120 is a vulnerability in Amazon FreeRTOS up to and including v1.4.8 that lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents to an attacker.
How severe is CVE-2019-13120?
CVE-2019-13120 has a severity score of 7.5, which is considered high.
What software versions are affected by CVE-2019-13120?
Versions up to and including v1.4.8 of Amazon FreeRTOS are affected by CVE-2019-13120.
What is the Common Weakness Enumeration (CWE) for CVE-2019-13120?
The Common Weakness Enumeration (CWE) for CVE-2019-13120 is CWE-125.
How can I fix CVE-2019-13120?
To mitigate CVE-2019-13120, it is recommended to update Amazon FreeRTOS to a version that includes the fix.