{"id":"CVE-2020-17438","aliases":["EUVD-2020-9391","GHSA-wp96-g7r8-wxf4","SUSE-RU-2021:1517-1","SUSE-SU-2021:0663-1","SUSE-SU-2021:1164-1"],"status":"published","title":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that...","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.19294,"percentile":0.97361,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2020-12-11T22:25:49Z","modified":"2026-10-24T10:30:46Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-22.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-22.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP2","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP3","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4}],"products":[{"vendor":"uip_project","product":"uip"}],"references":[{"url":"https://www.kb.cert.org/vuls/id/815128","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource","advisory"]},{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17438"},{"url":"https://github.com/advisories/GHSA-wp96-g7r8-wxf4"},{"url":"https://www.suse.com/support/update/announcement/-2021-1517/suse-ru-20211517-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179908","tags":["report"]},{"url":"https://bugzilla.suse.com/1183421","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17438","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210663-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211164-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173886","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-17438","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.","status":"published","published":"2020-12-11T22:25:49Z","modified":"2024-08-04T13:53:17.404Z","updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2020-9391","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.","status":"published","published":"2020-12-11T22:25:49Z","modified":"2024-08-04T13:53:17Z","updated_at":"2026-11-03T03:07:27.538796Z"}],"ghsa":[{"id":"GHSA-wp96-g7r8-wxf4","title":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that...","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.","status":"published","published":"2022-05-24T17:36:09Z","modified":"2023-01-29T05:05:02Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:45:41.669563Z"}],"nvd":[{"id":"CVE-2020-17438","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.","status":"published","published":"2020-12-11T23:15:12.747Z","modified":"2026-06-17T02:58:55.97Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"CVE-2020-17438","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.","status":"published","published":"2020-12-11T23:15:12.747Z","modified":"2026-10-24T10:30:46.670590194Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"SUSE-RU-2021:1517-1","title":"Recommended update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\n- Enabled asynchronous logins for iscsi.service (bsc#1183421)\n- Fixed a login issue when target is delayed\n","status":"published","published":"2021-05-05T15:43:58Z","modified":"2026-02-04T03:26:46.090249Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2021:0663-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\nFixes for CVE-2019-17437, CVE-2020-17438, CVE-2020-13987 and CVE-2020-13988 (bsc#1179908):\n\n- check for TCP urgent pointer past end of frame\n- check for u8 overflow when processing TCP options\n- check for header length underflow during checksum calculation\n","status":"published","published":"2021-03-01T15:13:59Z","modified":"2026-02-04T02:29:28.898038Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:1164-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\n- CVE-2020-17437: uIP Out-of-Bounds Write (bsc#1179908)\n- CVE-2020-17438: uIP Out-of-Bounds Write (bsc#1179908)\n- CVE-2020-13987: uIP Out-of-Bounds Read (bsc#1179908)\n- CVE-2020-13988: uIP Integer Overflow (bsc#1179908)\n- Enabled no-wait ('-W') iscsiadm option for iscsi login service (bsc#1173886, bsc#1183421)\n- Added the ability to perform async logins (bsc#1173886)\n","status":"published","published":"2021-04-13T12:02:36Z","modified":"2026-02-04T04:00:32.310744Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}