CVE-2019-12263 — Race Condition in Vxworks

CWE-362 — Race ConditionCWE-787 — Out-of-bounds WriteCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
8.1HIGHNVD
EPSS
0.5%
top 32.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Siemens Power Meter 9410 FirmwareSiemens Ruggedcom Win7000 FirmwareSiemens Ruggedcom Win7018 Firmware+8 more
Timeline
PublishedAug 9
Latest updateMay 24

Description

Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state confusion due to race condition.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages11 packages

▶NVDwindriver/vxworks6.5 — 6.9.4.12+1

🔴Vulnerability Details

3
GHSA
GHSA-34m3-97v7-926m: Wind River VxWorks 6↗2022-05-24
▶
CVEList
CVE-2019-12263: Wind River VxWorks 6↗2019-08-09
▶
VulnCheck
windriver vxworks Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')↗2019
▶
CVE-2019-12263 — Race Condition in Windriver Vxworks | cvebase