CVE-2018-16524: FreeRTOS TCP/IP

[senier]

Description

Each one of the TCP option handlers can access data out of bounds, and in some cases an attacker can get this data back (thus leaking information).

Root cause

Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow information disclosure during parsing of TCP options in prvCheckOptions.

Software

Name

FreeRTOS

Versions affected

1.3.1 - 10.0.1

Links

• CVE Entry
• In-depth analysis