CVE-2020-10019: Buffer Overflow in USB DFU requested length
USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size. This could be used by a malicious USB host to exploit the buffer overflow. See NCC-ZEP-002 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10019?
CVE-2020-10019 is classified as a high severity vulnerability due to the potential for remote exploitation through a buffer overflow.
How do I fix CVE-2020-10019?
To fix CVE-2020-10019, update to Zephyr version 1.14.2 or later, or apply relevant patches.
What software is affected by CVE-2020-10019?
CVE-2020-10019 affects Zephyr versions 1.14.1 and later, specifically versions up to 1.14.2 and between 2.0.0 and 2.1.0.
What happens if CVE-2020-10019 is exploited?
If exploited, CVE-2020-10019 could allow a malicious USB host to cause a buffer overflow, potentially leading to arbitrary code execution.
Is CVE-2020-10019 specific to a particular operating system?
CVE-2020-10019 is specific to the Zephyr RTOS used in various embedded devices.