Unbounded Memory Copy Vulnerability in Das U-Boot by Denx
CVE-2019-14199

9.8CRITICAL

Key Information:

Vendor

Denx

Status
U-boot
Vendor
CVE Published:
31 July 2019

What is CVE-2019-14199?

A vulnerability has been identified in Das U-Boot, where an unbounded memory copy occurs while processing UDP packets. This stems from an integer underflow in the net_process_received_packet function during the udp_packet_handler call. This can lead to potential data corruption or unintended behaviors, which poses a risk if exploited.

References

https://gitlab.com/u-boot/u-boot
x_refsource_MISC
https://blog.semmle.com/uboot-rce-nfs-vulnerability/
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.