CVE-2020-28895

In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.

CVSS v3 7.3 HIGH
CVSS v2.0 7.5 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-28895	Vendor Advisory
https://support2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327	Permissions Required
https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:windriver:vxworks::::::::
	cpe:2.3:o:windriver:vxworks:6.9.4.12:-::::::
	cpe:2.3:o:windriver:vxworks:6.9.4.12:rolling_cumulative_patch_layer1::::::

Configuration 2 (hide)

OR	cpe:2.3:a:oracle:communications_eagle::::::::
	cpe:2.3:a:oracle:communications_eagle::::::::
	cpe:2.3:a:oracle:communications_eagle:46.7.0:::::::*

History

No history.

Information

Published : 2021-02-03 16:15

Updated : 2024-02-28 18:08

NVD link : CVE-2020-28895

Mitre link : CVE-2020-28895

CVE.ORG link : CVE-2020-28895

JSON object : View

Products Affected

windriver

vxworks

oracle

communications_eagle

CWE

CWE-190

Integer Overflow or Wraparound

CWE-787

Out-of-bounds Write

{"id": "CVE-2020-28895", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2021-02-03T16:15:13.633", "references": [{"url": "https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-28895", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://support2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327", "tags": ["Permissions Required"], "source": "cve@mitre.org"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption."}, {"lang": "es", "value": "En Wind River VxWorks, el asignador de memoria presenta un posible desbordamiento en el calculo del tama\u00f1o del bloque de memoria que se asignar\u00e1 por medio de la funci\u00f3n calloc(). Como resultado, la memoria real asignada es menor que el tama\u00f1o del b\u00fafer especificado por los argumentos, conllevando a una corrupci\u00f3n en la memoria"}], "lastModified": "2022-05-12T14:33:14.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E27E761-92D8-4A67-8D23-213E0C7BFFC6", "versionEndExcluding": "6.9.4.12", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:windriver:vxworks:6.9.4.12:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69674D4D-2848-46BA-9367-7AA85EE2CD99"}, {"criteria": "cpe:2.3:o:windriver:vxworks:6.9.4.12:rolling_cumulative_patch_layer1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1052B8F5-1BC4-46B6-A8F1-F1BF9A40DDAF"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:communications_eagle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1507EFE2-DA83-42D7-B075-91EE060B6B35", "versionEndIncluding": "48.6.2", "versionStartIncluding": "46.8.0"}, {"criteria": "cpe:2.3:a:oracle:communications_eagle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4143A5F6-CD91-4209-A52B-98854CCAC987", "versionEndIncluding": "46.9.3", "versionStartIncluding": "46.9.1"}, {"criteria": "cpe:2.3:a:oracle:communications_eagle:46.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FED9166-7A2A-453D-9792-7A6361CEF594"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}