CVE-2020-35198

An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-35198	Vendor Advisory
https://support2.windriver.com/index.php?page=security-notices	Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:windriver:vxworks::::::::
	cpe:2.3:o:windriver:vxworks::::::::
	cpe:2.3:o:windriver:vxworks:6.9.4.12:-::::::
	cpe:2.3:o:windriver:vxworks:6.9.4.12:rolling_cumulative_patch_layer1::::::
	cpe:2.3:o:windriver:vxworks:6.9.4.12:rolling_cumulative_patch_layer2::::::

Configuration 2 (hide)

OR	cpe:2.3:a:oracle:communications_eagle::::::::
	cpe:2.3:a:oracle:communications_eagle::::::::
	cpe:2.3:a:oracle:communications_eagle:46.7.0:::::::*

History

No history.

Information

Published : 2021-05-12 11:15

Updated : 2022-05-12 14:06

NVD link : CVE-2020-35198

Mitre link : CVE-2020-35198

CVE.ORG link : CVE-2020-35198

JSON object : View

Products Affected

oracle

communications_eagle

windriver

vxworks

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2020-35198", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-05-12T11:15:07.837", "references": [{"url": "https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-35198", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://support2.windriver.com/index.php?page=security-notices", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Wind River VxWorks versi\u00f3n 7. El asignador de memoria presenta un posible desbordamiento de enteros al calcular el tama\u00f1o de un bloque de memoria que es asignado por una funci\u00f3n calloc(). Como resultado, la memoria actual asignada es menor que el tama\u00f1o del b\u00fafer especificado por los argumentos, conllevando a una corrupci\u00f3n de la memoria"}], "lastModified": "2022-05-12T14:06:23.453", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E27E761-92D8-4A67-8D23-213E0C7BFFC6", "versionEndExcluding": "6.9.4.12", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB07AF57-0F8D-4DCD-80DA-64096674F017", "versionEndExcluding": "21.03", "versionStartIncluding": "7.0"}, {"criteria": "cpe:2.3:o:windriver:vxworks:6.9.4.12:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69674D4D-2848-46BA-9367-7AA85EE2CD99"}, {"criteria": "cpe:2.3:o:windriver:vxworks:6.9.4.12:rolling_cumulative_patch_layer1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1052B8F5-1BC4-46B6-A8F1-F1BF9A40DDAF"}, {"criteria": "cpe:2.3:o:windriver:vxworks:6.9.4.12:rolling_cumulative_patch_layer2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AABF1E5-DA6B-462D-A047-EC843F94568E"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:communications_eagle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D23D483-D206-46C5-8BFE-4FA23DD8AB52", "versionEndIncluding": "46.8.2", "versionStartIncluding": "46.8.0"}, {"criteria": "cpe:2.3:a:oracle:communications_eagle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4143A5F6-CD91-4209-A52B-98854CCAC987", "versionEndIncluding": "46.9.3", "versionStartIncluding": "46.9.1"}, {"criteria": "cpe:2.3:a:oracle:communications_eagle:46.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FED9166-7A2A-453D-9792-7A6361CEF594"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}