Vulnerability Description
TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vulnerability in Function get_package_name in the file kernel/src/tbfheader.rs, variable "pub package_name: &'static str," in the file process.rs that can result in A tock capsule (untrusted driver) could access arbitrary memory by using only safe code. This vulnerability appears to have been fixed in commit 42f7f36e74088036068d62253e1d8fb26605feed.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tockos | Tock | < 1.2 |
Related Weaknesses (CWE)
References
- https://github.com/tock/tock/issues/1147Issue TrackingPatchThird Party Advisory
- https://github.com/tock/tock/issues/1147Issue TrackingPatchThird Party Advisory
FAQ
What is CVE-2018-1000660?
CVE-2018-1000660 is a vulnerability with a CVSS score of 7.5 (HIGH). TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vulnerability in Function get_package_name i...
How severe is CVE-2018-1000660?
CVE-2018-1000660 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1000660?
Check the references section above for vendor advisories and patch information. Affected products include: Tockos Tock.