Skip to content
OpenAdvisories
High · 8.0 CVE-2020-10060 EUVD-2020-2525GHSA-435h-hqgw-fqgf

UpdateHub Might Dereference An Uninitialized Pointer

Published May 11, 2020 · Updated Sep 16, 2024 · Assigned by zephyr

Description

In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.

Affected products

VendorProductAffectedFixed
zephyrproject-rtos zephyr 2.1.0 – < unspecified, 2.2.0 – < unspecified unspecified

References