CVE-2020-24341

Name of the Vulnerable Software and Affected Versions picoTCP and picoTCP-NG versions through 1.7.0

Description The issue arises from the TCP input data processing function in pico tcp.c, which fails to validate the length of incoming TCP packets. This leads to an out-of-bounds read when assembling received packets into a data segment. As a result, it can cause Denial-of-Service or an information leak.

Recommendations For picoTCP and picoTCP-NG versions through 1.7.0, consider updating to a version that includes a fix for the TCP input data processing function in pico tcp.c to validate the length of incoming TCP packets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.