Null Pointer Dereference Vulnerability in Newlib for Various Embedded Systems
CVE-2019-14871

6.5MEDIUM

Key Information:

Vendor
Red Hat
Status
Newlib
Vendor
CVE Published:
18 March 2020

Summary

In Newlib before version 3.3.0, the REENT_CHECK macro does not adequately handle memory allocation issues when the DEBUG flag is disabled. This oversight can lead to null pointer dereference vulnerabilities in production firmware, potentially causing system instability or crashes. It primarily affects embedded systems relying on this library for memory management, thereby necessitating prompt updates to mitigate associated risks.

Affected Version(s)

newlib all newlib versions prior to 3.3.0

References

https://census-labs.com/news/2020/01/31/multiple-null-poi...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.