Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2020-10022

UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
zephyr

Description

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

zephyrproject-rtos zephyr

  • 2.1.0 to < unspecifiedaffected
  • 2.2.0 to < unspecifiedaffected

References