CVE-2020-17529 Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header
An attacker can corrupt memory and potentially execute code or cause denial of service in Apache NuttX by sending malformed IP packets with invalid fragmentation offsets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-17529?
CVE-2020-17529 is a critical memory corruption vulnerability in Apache NuttX (incubating), published on 9 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying and invalid fragmentation offset value specified in the IP header. This is only impacts builds with both CONFIG_EXPERIMENTAL and CONFIG_NET_TCP_REASSEMBLY build flags enabled.
Weakness: CWE-787
Which versions are affected by CVE-2020-17529?
It affects 1 product.
Products include Apache Nuttx.
How do I fix CVE-2020-17529?
No fix has been published for CVE-2020-17529 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-17529 being exploited?
There is no known exploitation of CVE-2020-17529 in the wild and no public exploit code.
Other vulnerabilities in Apache NuttX (incubating)
- CVE-2025-47868 Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.
- CVE-2025-47869 Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size.
- CVE-2025-35003 Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.
- CVE-2021-26461 malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds
- CVE-2020-1939 Null dereference in Apache NuttX (incubating)
Sources
Also known as GHSA-5jrc-q622-h2ww.