Description
xProcessReceivedTCPPacket doesn’t validate that the received frame is large enough to contain a TCP header. Fields of the TCP header can be accessed out of bounds.
Root cause
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds access to TCP source and destination port fields in xProcessReceivedTCPPacket can leak data back to an attacker.
Software
Name
FreeRTOS
Versions affected
1.3.1 - 10.0.1
Links
Description
xProcessReceivedTCPPacket doesn’t validate that the received frame is large enough to contain a TCP header. Fields of the TCP header can be accessed out of bounds.
Root cause
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds access to TCP source and destination port fields in xProcessReceivedTCPPacket can leak data back to an attacker.
Software
Name
FreeRTOS
Versions affected
1.3.1 - 10.0.1
Links