CVE-2018-16600: FreeRTOS TCP/IP

[senier]

Description

eARPProcessPacket doesn’t validate that the received frame is large enough to be an ARP packet.

Root cause

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of ARP packets in eARPProcessPacket can be used for information disclosure.

Software

Name

FreeRTOS

Versions affected

1.3.1 - 10.0.1

Exploit

https://github.com/Componolit/systematization-binary-vulnerabilities/blob/master/examples/src/vuln_74.c

Links

• CVE Entry
• In-depth analysis