CVE-2019-15134: High severity riot os vulnerability
RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrctcp), allowing an attacker to consume all memory available for network packets and thus effectively stopping all network threads from working. This is related to receive in sys/net/gnrc/transportlayer/tcp/gnrctcpeventloop.c upon receiving an ACK before a SYN.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15134?
CVE-2019-15134 has a moderate severity due to its potential to cause network service disruptions.
How do I fix CVE-2019-15134?
To fix CVE-2019-15134, upgrade to a version of RIOT later than 2019.07 that has the memory leak issue patched.
What components are affected by CVE-2019-15134?
CVE-2019-15134 affects the TCP implementation found in the GNRC networking stack of RIOT OS.
How can CVE-2019-15134 be exploited?
An attacker can exploit CVE-2019-15134 by sending a flood of TCP packets to consume all available memory allocated for network operations.
Is there a workaround for CVE-2019-15134?
Currently, there is no specific workaround for CVE-2019-15134 other than applying the recommended update to mitigate the issue.