Erlang/OTP CVE-2020-17538: Signed Length Overflow in Inet TCP Driver

Summary of the Signed Length Overflow Vulnerability in the Erlang/OTP inet TCP Driver Vulnerability Overview Vulnerability Name: Signed length overflow in the inet TCP driver of Erlang/OTP, originating from an unauthenticated peer, causing the receive buffer to overflow into BEAM VM memory. CVE ID: CVE-2020-17538 Severity: High (CVSS v2 base score 8.2/10) Vulnerability Type: Signed length calculation error. An attacker can craft a malformed packet length, causing the receive buffer to overflow beyond the VM's allocated region. The overflow can extend up to approximately 2GB, potentially causing the BEAM VM to crash. Scope of Impact Affected Package: (package name ) Affected Versions: - - Fixed Versions: - - Trigger Conditions: Connection to an open Erlang TCP port using the inet driver in mode, where the port is accessible to unauthenticated entities. Exploitability: This vulnerability can lead to remote code execution (RCE), with a severity rating of High. Remediation Upgrade: Upgrade Erlang/OTP to one of the fixed versions (see the "Fixed Versions" list above). Temporary Mitigations (Workarounds): 1. Set the options or , setting to a signed value less than 2^31 to limit the packet length. 2. Avoid having the application directly allocate 2GB of memory (most applications do not do this). 3. Avoid allowing TCP ports using to be accessed by unauthenticated entities. Version Comparison Note: Newer OTP versions use a new versioning scheme. Older versions (prior to OTP 17.0) may not be correctly defined during version comparison; therefore, versions prior to 17.0 may also be affected. POC / Exploit Code The page does not include a POC or exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP CVE-2020-17538: Signed Length Overflow in Inet TCP Driver

More from this source