CVE-2020-10071 - Insufficient publish message length validation in MQTT

Back Back to CVE browser

CRITICAL

Insufficient publish message length validation in MQTT

Published Jun 5, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 3.40%

Description

The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

Affected products

Vendor Zephyrproject-Rtos Product Zephyr Default
n/a
- Version
  2.2.0
  Status
  affected
  Constraints
  <unspecified

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zephyrproject-Rtos

Zephyr

n/a

Version	Status	Constraints
2.2.0	affected	<unspecified

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-120

Classic Buffer Overflow

CWE-129

References (4)

https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10071
x_refsource_MISCVendor Advisory
https://github.com/zephyrproject-rtos/zephyr/pull/23821/commits/989c4713ba429aa5105fe476b4d629718f3e6082
x_refsource_MISCPatchThird Party Advisory
https://research.nccgroup.com/2020/05/26/research-report-zephyr-and-mcuboot-security-assessment
x_refsource_MISCThird Party Advisory
https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-86
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10071		x_refsource_MISCVendor Advisory
https://github.com/zephyrproject-rtos/zephyr/pull/23821/commits/989c4713ba429aa5105fe476b4d629718f3e6082		x_refsource_MISCPatchThird Party Advisory
https://research.nccgroup.com/2020/05/26/research-report-zephyr-and-mcuboot-security-assessment		x_refsource_MISCThird Party Advisory
https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-86		x_refsource_MISCThird Party Advisory