Contiki-NG up to 4.5 SNMP snmp_engine_get_bulk SNMP Request out-of-bounds write

Summaryinfo

A vulnerability was found in Contiki-NG up to 4.5. It has been rated as critical. Affected is the function snmp_engine_get_bulk of the component SNMP Handler. This manipulation as part of SNMP Request causes out-of-bounds write. This vulnerability is tracked as CVE-2020-14935. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Contiki-NG up to 4.5. It has been declared as critical. Affected by this vulnerability is the function snmp_engine_get_bulk of the component SNMP Handler. The manipulation as part of a SNMP Request leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Buffer overflows were discovered in Contiki-NG 4.4 through 4.5, in the SNMP bulk get request response encoding function. The function parsing the received SNMP request does not verify the input message's requested variables against the capacity of the internal SNMP engine buffer. When a bulk get request response is assembled, a stack buffer dedicated for OIDs (with a limited capacity) is allocated in snmp_engine_get_bulk(). When snmp_engine_get_bulk() is populating the stack buffer, an overflow condition may occur due to lack of input length validation. This makes it possible to overwrite stack regions beyond the allocated buffer, including the return address from the function. As a result, the code execution path may be redirected to an address provided in the SNMP bulk get payload. If the target architecture uses common addressing space for program and data memory, it may also be possible to supply code in the SNMP request payload, and redirect the execution path to the remotely injected code, by modifying the function's return address.

The weakness was disclosed 08/18/2020. This vulnerability is known as CVE-2020-14935 since 06/21/2020. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-160029, VDB-160028 and VDB-160026 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Contiki-NG

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion