CVE-2020-22284 — Classic Buffer Overflow in Lwip

CWE-120 — Classic Buffer Overflow4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 39.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Lwip Project LwipDebian Lwip
Timeline
PublishedJul 22
Latest updateMay 24

Description

A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2 allows attackers to access sensitive information via a crafted 6LoWPAN packet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/lwip< lwip 2.1.3+dfsg1-1 (bookworm)
▶Debianlwip_project/lwip< 2.1.2+dfsg1-8+deb11u1+3

Patches

Patch: savannah.nongnu.org ↗Patch: savannah.nongnu.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-4f64-6qh9-pmfj: A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2↗2022-05-24
▶
OSV
CVE-2020-22284: A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2↗2021-07-22
▶

📋Vendor Advisories

1
Debian
CVE-2020-22284: lwip - A buffer overflow vulnerability in the zepif_linkoutput() function of Free Softw...↗2020
▶