CVE-2020-24334

The code that processes DNS responses in uIP through 1.0, as used in Contiki and Contiki-NG, does not check whether the number of responses specified in the DNS packet header corresponds to the response data available in the DNS packet, leading to an out-of-bounds read and Denial-of-Service in resolv.c.
References
Link Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 Third Party Advisory US Government Resource
https://www.kb.cert.org/vuls/id/815128 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:uip_project:uip:*:*:*:*:*:*:*:*
OR cpe:2.3:o:contiki-ng:contiki-ng:-:*:*:*:*:*:*:*
cpe:2.3:o:contiki-os:contiki:-:*:*:*:*:*:*:*

Information

Published : 2020-12-11 23:15

Updated : 2020-12-15 15:03


NVD link : CVE-2020-24334

Mitre link : CVE-2020-24334


JSON object : View

Products Affected

uip_project

  • uip

contiki-os

  • contiki

contiki-ng

  • contiki-ng
CWE
CWE-125

Out-of-bounds Read