CVE-2020-10060: UpdateHub Might Dereference An Uninitialized Pointer
In updatehubprobe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10060?
CVE-2020-10060 has been rated as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2020-10060?
To fix CVE-2020-10060, ensure that your version of the Zephyr Project Manager is updated to at least 2.4.0.
What types of systems are affected by CVE-2020-10060?
CVE-2020-10060 affects systems using the Zephyr Project Manager version between 2.1.0 and 2.4.0.
What are the potential consequences of CVE-2020-10060?
The potential consequences of CVE-2020-10060 include crashes and denial of service due to uninitialized stack memory access.
Is CVE-2020-10060 a remote exploit vulnerability?
CVE-2020-10060 is not a remote exploit vulnerability, but it can lead to local execution issues if exploited.