CVE-2020-14935 Memory corruption in n/a
Remote attackers can execute arbitrary code via stack buffer overflow in Contiki-NG's SNMP bulk get request handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14935?
CVE-2020-14935 is a critical memory corruption vulnerability in n/a, published on 18 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflows were discovered in Contiki-NG 4.4 through 4.5, in the SNMP bulk get request response encoding function. The function parsing the received SNMP request does not verify the input message's requested variables against the capacity of the internal SNMP engine buffer. When a bulk get request response is assembled, a stack buffer dedicated for OIDs (with a limited capacity) is allocated in snmp_engine_get_bulk(). When snmp_engine_get_bulk() is populating the stack buffer, an overflow condition may occur due to lack of input length validation. This makes it possible to overwrite stack regions beyond the allocated buffer, including the return address from the function. As a result, the code execution path may be redirected to an address provided in the SNMP bulk get payload. If the target architecture uses common addressing space for program and data memory, it may also be possible to supply code in the SNMP request payload, and redirect the execution path to the remotely injected code, by modifying the function's return address.
Weakness: CWE-787
Which versions are affected by CVE-2020-14935?
It affects 1 product.
Products include Contiki-Ng Contiki-Ng.
How do I fix CVE-2020-14935?
No fix has been published for CVE-2020-14935 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-14935 being exploited?
There is no known exploitation of CVE-2020-14935 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cvph-4f6c-4mg7.