CVE-2020-17443: altran picotcp Integer Overflow or Wraparound
Vulnerability summary
CVE-2020-17443 is a high (CVSS 7.5) Integer Overflow or Wraparound vulnerability in altran picotcp. EPSS estimates a 2.83% chance of exploitation in the next 30 days, higher than 86.5% of scored vulnerabilities.
Timeline
- 11-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6 echo request packet's size is shorter than 8 bytes. If the size of the incoming ICMPv6 request packet is shorter than this, the operation that calculates the size of the ICMPv6 echo replies has an integer wrap around, leading to memory corruption and, eventually, Denial-of-Service in pico_icmp6_send_echoreply_not_frag in pico_icmp6.c.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.83%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 2.83% on 22-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Altran1 product
- picotcp≤ 1.7.0
1 vendor · 1 product
References
2 links
us-cert.cisa.gov/ics/advisories/icsa-20-343-01X Refsource MISCThird Party AdvisoryUS Government Resource