CVE-2018-16527: FreeRTOS TCP/IP

[senier]

Description

prvProcessICMPPacket doesn’t validate that the received frame is large enough to be an ICMP packet, and can access fields from this packet out of bounds.

Root cause

Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow information disclosure during parsing of ICMP packets in prvProcessICMPPacket.

Software

Name

FreeRTOS-Plus-TCP

Versions affected

< 2.0.7

Fix

FreeRTOS/FreeRTOS-Plus-TCP@b95fdc3

Exploit

https://github.com/Componolit/systematization-binary-vulnerabilities/blob/master/examples/src/vuln_75.c

Links

• CVE Entry
• In-depth analysis