Every CVE Search/ Get API key

CVE-2020-17438

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that...

9.8 Critical

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

19.3%Up 17.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.

Record
CVE-2020-17438
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.

Record
CVE-2020-17438
Updated
2026-11-02
EUVDEUVD-2020-9391 No score

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.

Record
EUVD-2020-9391
Updated
2026-11-03
GitHub AdvisoriesGHSA-wp96-g7r8-wxf4 No score

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that...

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.

Record
GHSA-wp96-g7r8-wxf4
Weakness
CWE-787
Updated
2026-11-02
OSV 9.8

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.

Record
CVE-2020-17438
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVSUSE-RU-2021:1517-1 No score

Recommended update for open-iscsi

This update for open-iscsi fixes the following issues:

  • Enabled asynchronous logins for iscsi.service (bsc#1183421)
  • Fixed a login issue when target is delayed
Record
SUSE-RU-2021:1517-1
Updated
2026-11-02
OSVSUSE-SU-2021:0663-1 No score

Security update for open-iscsi

This update for open-iscsi fixes the following issues:

Fixes for CVE-2019-17437, CVE-2020-17438, CVE-2020-13987 and CVE-2020-13988 (bsc#1179908):

  • check for TCP urgent pointer past end of frame
  • check for u8 overflow when processing TCP options
  • check for header length underflow during checksum calculation
Record
SUSE-SU-2021:0663-1
Updated
2026-11-02
OSVSUSE-SU-2021:1164-1 No score

Security update for open-iscsi

This update for open-iscsi fixes the following issues:

  • CVE-2020-17437: uIP Out-of-Bounds Write (bsc#1179908)
  • CVE-2020-17438: uIP Out-of-Bounds Write (bsc#1179908)
  • CVE-2020-13987: uIP Out-of-Bounds Read (bsc#1179908)
  • CVE-2020-13988: uIP Integer Overflow (bsc#1179908)
  • Enabled no-wait ('-W') iscsiadm option for iscsi login service (bsc#1173886, bsc#1183421)
  • Added the ability to perform async logins (bsc#1173886)
Record
SUSE-SU-2021:1164-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
open-iscsi
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 4 CVEs
 before 2.1.4-22.14.1
2.1.4-22.14.1
open-iscsi
SUSE:Linux Enterprise Micro 5.0
From an advisory covering 4 CVEs
 before 2.1.4-22.14.1
2.1.4-22.14.1
open-iscsi
SUSE:OpenStack Cloud 9
From an advisory covering 4 CVEs
 before 2.0.876-12.27.2
2.0.876-12.27.2
open-iscsi
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 4 CVEs
 before 2.0.876-12.27.2
2.0.876-12.27.2
open-iscsi
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 4 CVEs
 before 2.0.876-12.27.2
2.0.876-12.27.2
open-iscsi
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 4 CVEs
 before 2.0.876-12.27.2
2.0.876-12.27.2
open-iscsi
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 4 CVEs
 before 2.0.876-12.27.2
2.0.876-12.27.2
open-iscsi
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 4 CVEs
 before 2.0.876-12.27.2
2.0.876-12.27.2
open-iscsi
SUSE:Linux Enterprise Module for Legacy 15 SP2
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Linux Enterprise Module for Legacy 15 SP3
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
open-iscsi
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Manager Proxy 4.0
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Manager Server 4.0
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1
open-iscsi
SUSE:Enterprise Storage 6
From an advisory covering 4 CVEs
 before 2.0.876-13.42.1
2.0.876-13.42.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-17438 is a critical vulnerability (CVSS 9.8) in Uip Project Uip, published December 11, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 19.3%, the 97th percentile. No source names a fixed version.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open