CVE-2020-10060— UpdateHub Might Dereference An Uninitialized Pointer
Quick assessment
Affected
zephyrproject-rtos zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Zephyr是美国Linux基金会的一套开源的小型的可缩放的实时操作系统。 Zephyr 2.1.0及之后版本和2.2.0及之后版本中的updatehub_probe中存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-10060
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
UpdateHub Might Dereference An Uninitialized Pointer
Source: CVE Program / CVE List V5
Vulnerability Description
In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
内存缓冲区边界内操作的限制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Zephyr 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Zephyr是美国Linux基金会的一套开源的小型的可缩放的实时操作系统。 Zephyr 2.1.0及之后版本和2.2.0及之后版本中的updatehub_probe中存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zephyrproject-rtos | zephyr | 2.1.0 ~ unspecified | - |
|
II. Public POCs for CVE-2020-10060
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-10060
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-10060 (4)
-
https://github.com/zephyrproject-rtos/zephyr/pull/27891 x_refsource_CONFIRM
-
https://github.com/zephyrproject-rtos/zephyr/pull/27893 x_refsource_CONFIRM
-
https://github.com/zephyrproject-rtos/zephyr/pull/27889 x_refsource_CONFIRM
-
https://github.com/zephyrproject-rtos/zephyr/pull/27865 x_refsource_CONFIRM
Other References for CVE-2020-10060 (1)
-
https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-37 x_refsource_MISC
Same Patch Batch · zephyrproject-rtos · 2020-05-11 · 11 CVEs total
| CVE-2020-10022 | 9.0 CRITICAL | UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array |
| CVE-2020-10019 | 8.1 HIGH | Buffer Overflow in USB DFU requested length |
| CVE-2020-10021 | 8.1 HIGH | Out-of-bounds write in USB Mass Storage with unaligned sizes |
| CVE-2020-10024 | 7.8 HIGH | ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers |
| CVE-2020-10027 | 7.8 HIGH | ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers |
| CVE-2020-10028 | 7.8 HIGH | Multiple Syscalls In GPIO Subsystem Performs No Argument Validation |
| CVE-2020-10058 | 7.8 HIGH | Multiple Syscalls In kscan Subsystem Performs No Argument Validation |
| CVE-2020-10067 | 7.5 HIGH | Integer Overflow In is_in_region Allows User Thread To Access Kernel Memory |
| CVE-2020-10023 | 6.9 MEDIUM | Shell Subsystem Contains a Buffer Overflow Vulnerability In shell_spaces_trim |
| CVE-2020-10059 | 4.8 MEDIUM | UpdateHub Module Explicitly Disables TLS Verification |
IV. Related Vulnerabilities
Same product: zephyr
-
CVE-2026-17053
SMBus callback-removal syscalls accept an unvalidated user p -
CVE-2026-18747
Integer underflow of net_buf length in the MCUmgr serial (SM -
CVE-2026-18746
NULL pointer dereference in Zephyr LwM2M client when the CoA -
CVE-2026-18417
Wild pointer dereference in Zephyr BSD sockets when a TCP li -
CVE-2026-18416
Out-of-bounds read in CoAP well-known-core Uri-Query href ma
Same vendor: zephyrproject-rtos
-
CVE-2026-13351
net: Maliciously fragmented IPv6 packets can prevent receivi -
CVE-2026-5068
bt: l2cap le coc: remote oob write via seg counter stored in -
CVE-2026-5067
Out-of-bounds read/write in HTTP WebSocket upgrade via non-n -
CVE-2026-5066
net: sockets: tls: Potential out-of-bounds write/read in soc -
CVE-2026-5589
Out-of-bounds write caused by an integer underflow in the Bl
Same weakness: CWE-119
-
CVE-2026-47602
NVIDIA驱动解引用漏洞致拒绝服务与信息泄露 -
CVE-2026-47550
NVIDIA Windows驱动内核空指针解引用漏洞 -
CVE-2026-100892
aligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer m -
CVE-2026-58005
Unvalidated SiP v2 mailbox pointers allow non-secure EL1 acc -
CVE-2026-20352
Cisco Identity Services Engine RADIUS Denial of Service Vuln
V. Comments for CVE-2020-10060
No comments yet