CVE-2020-10066: Incorrect Error Handling in Bluetooth HCI core

Q: What is the severity of CVE-2020-10066?

CVE-2020-10066 is classified as a high severity vulnerability due to the potential for NULL Pointer Dereference.

Q: How do I fix CVE-2020-10066?

To fix CVE-2020-10066, upgrade to Zephyr versions later than 1.14.2 or between 2.0.0 and 2.2.0.

Q: What systems are affected by CVE-2020-10066?

CVE-2020-10066 affects Zephyr versions older than 1.14.2 and versions from 2.0.0 up to 2.2.0.

Q: What type of vulnerability is CVE-2020-10066?

CVE-2020-10066 is a NULL Pointer Dereference vulnerability which can lead to improper error handling.

Q: Is CVE-2020-10066 still a threat?

CVE-2020-10066 remains a threat for systems running vulnerable versions of Zephyr that have not been updated.

Published May 24, 2021

Updated

Incorrect Error Handling in Bluetooth HCI core. Zephyr versions >= v1.14.2, >= v2.2.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr

Affected Software

2 affected components

zephyrproject zephyr<=1.14.2

zephyrproject zephyr>=2.0.0<=2.2.0

Remediation

Patch Available

http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr

Event History

May 24, 2021

CVE Published

via MITRE·09:40 PM

Data Sourced

via MITRE·09:40 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-10066?

CVE-2020-10066 is classified as a high severity vulnerability due to the potential for NULL Pointer Dereference.

How do I fix CVE-2020-10066?