CVE-2020-22283 — Classic Buffer Overflow in Lwip

CWE-120 — Classic Buffer Overflow4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 47.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Lwip Project LwipDebian Lwip
Timeline
PublishedJul 22
Latest updateMay 24

Description

A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head allows attackers to access sensitive information via a crafted ICMPv6 packet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶debiandebian/lwip< lwip 2.1.3+dfsg1-1 (bookworm)
▶Debianlwip_project/lwip< 2.1.2+dfsg1-8+deb11u1+3

Patches

Patch: savannah.nongnu.org ↗Patch: savannah.nongnu.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-8gr9-6mc8-jj84: A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head allows at↗2022-05-24
▶
OSV
CVE-2020-22283: A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head allows at↗2021-07-22
▶

📋Vendor Advisories

1
Debian
CVE-2020-22283: lwip - A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif(...↗2020
▶