Buffer Overflow Vulnerability in RIOT OS Decoder
CVE-2020-15350

9.8CRITICAL

Key Information:

Vendor

Riot-os

Status
Riot
Vendor
CVE Published:
7 July 2020

What is CVE-2020-15350?

The RIOT OS 2020.04 version contains a vulnerability in its base64 decoder, specifically within the base64_decode() function. This function utilizes an output buffer estimation method that inaccurately calculates the buffer size needed for decoded output, primarily due to an arithmetic rounding error. Additionally, it fails to account for potential padding bytes when estimating the expected decoded size. As a result, this vulnerability can be exploited by creating a crafted base64 input, leading to a buffer overflow situation that may compromise the integrity of the system.

References

https://drive.google.com/file/d/1jMCAi8uawV1-an5uCghIxT2T...
x_refsource_MISC
https://github.com/RIOT-OS/RIOT/pull/14400
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.