CVE-2020-10060 — In updatehub_probe, right after JSON parsing is complete, objects\[1] is accesse

In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service

01What is this vulnerability?

In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the…

02Affected products

Vendor	Product	Versions
zephyrproject-rtos	zephyr	2.1.0, 2.2.0

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

08Timeline

• Published: 2020-05-11T22:26:16.934Z
• Last modified: 2024-09-16T23:31:11.924Z

09References

• zephyrprojectsec.atlassian.net — https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-37
• docs.zephyrproject.org — https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-100…
• github.com — https://github.com/zephyrproject-rtos/zephyr/pull/27865
• github.com — https://github.com/zephyrproject-rtos/zephyr/pull/27889
• github.com — https://github.com/zephyrproject-rtos/zephyr/pull/27891
• github.com — https://github.com/zephyrproject-rtos/zephyr/pull/27893