Description
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
lwIP lwIP
Default version status: unaffected
2.0.0 to ≤ 2.2.1affected
References
- https://github.com/lwip-tcpip/lwip/commit/e98415014aca66ef0daefded8020763b9279a3b2 ↗
- https://github.com/lwip-tcpip/lwip ↗
- https://github.com/lwip-tcpip/lwip/blob/77dcd25a72509eb83f72b033d219b1d40cd8eb95/src/apps/snmp/snmp_pbuf_stream.c#L111-L122 ↗
- https://www.vulncheck.com/advisories/lwip-2.0.0-through-2.2.1-snmp-agent-out-of-bounds-read-via-snmp-pbuf-stream-writeto ↗