Vulnerability Description
Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker has the authorization to send a malformed MQTT publish packet to an Amazon IoT Thing, which interacts with an associated vulnerable MQTT message in the application, specific circumstances could trigger this vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Amazon Web Services Freertos | <= 1.4.8 |
Related Weaknesses (CWE)
References
- https://aws.amazon.com/cn/freertos/security-updates/Vendor Advisory
- https://aws.amazon.com/cn/freertos/security-updates/Vendor Advisory
FAQ
What is CVE-2019-13120?
CVE-2019-13120 is a vulnerability with a CVSS score of 7.5 (HIGH). Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker...
How severe is CVE-2019-13120?
CVE-2019-13120 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-13120?
Check the references section above for vendor advisories and patch information. Affected products include: Amazon Amazon Web Services Freertos.