CVE-2020-13910 — Out-of-bounds Read in Barebox

CWE-125 — Out-of-bounds Read2 documents2 sources
Severity
9.1CRITICALNVD
EPSS
0.4%
top 37.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Pengutronix Barebox
Timeline
PublishedJun 7
Latest updateMay 24

Description

Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an incoming network packet is directly used as a length field without any bounds check.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages1 packages

▶NVDpengutronix/barebox2020.05.0

Patches

Patch: git.pengutronix.de ↗Patch: git.pengutronix.de ↗

🔴Vulnerability Details

1
GHSA
GHSA-cv8c-hmjr-8xv4: Pengutronix Barebox through v2020↗2022-05-24
▶