Candidate: CVE-2020-17437
CRD: 2020-12-01
PublicDate: 2020-12-11 23:15:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17437
 https://github.com/open-iscsi/open-iscsi/security/advisories/GHSA-r278-fm99-8rgp
 https://www.forescout.com/company/resources/amnesia33-how-tcp-ip-stacks-breed-critical-vulnerabilities-in-iot-ot-and-it-devices/
Description:
 An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other
 products. When the Urgent flag is set in a TCP packet, and the stack is
 configured to ignore the urgent data, the stack attempts to use the value
 of the Urgent pointer bytes to separate the Urgent data from the normal
 data, by calculating the offset at which the normal data should be present
 in the global buffer. However, the length of this offset is not checked;
 therefore, for large values of the Urgent pointer bytes, the data pointer
 can point to memory that is way beyond the data buffer in uip_process in
 uip.c.
Ubuntu-Description: 
Notes: 
 sbeattie> aka FSCT-2020-0018
 sbeattie> issue in embedded copy of uIP
 mdeslaur> per upstream "iscsiuio only uses uip for network "services",
 mdeslaur> such as DHCP, ARP, etc, and not for normal TCP/IP
 mdeslaur> communications"
Mitigation: 
Bugs: 
Priority: low
Discovered-by: Amine Amri and Stanislav Dashevskyi
Assigned-to: 
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H [8.2 HIGH]


Patches_open-iscsi:
 upstream: https://github.com/open-iscsi/open-iscsi/commit/d63ce0d64c5abe9f285f14ce394660bfb9a16538
upstream_open-iscsi: released (2.1.3)
precise/esm_open-iscsi: ignored (end of ESM support, was needed)
trusty_open-iscsi: ignored (out of standard support)
trusty/esm_open-iscsi: needed
xenial_open-iscsi: ignored (end of standard support, was needed)
esm-infra/xenial_open-iscsi: needed
bionic_open-iscsi: needed
focal_open-iscsi: needed
groovy_open-iscsi: ignored (reached end-of-life)
hirsute_open-iscsi: released (2.1.3-1ubuntu1)
impish_open-iscsi: released (2.1.3-1ubuntu1)
jammy_open-iscsi: released (2.1.3-1ubuntu1)
devel_open-iscsi: released (2.1.3-1ubuntu1)