buglwIP - A Lightweight TCP/IP stack - Bugs: bug #58724, Treck Ripple20 Issues in LWIP

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58724: Treck Ripple20 Issues in LWIP

Submitted by:  Subhan Waizi <swaizi>
Submitted on:  Tue 07 Jul 2020 07:44:18 PM UTC  
 
Category:  None Severity:  6 - Security
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  Other

Wed 08 Jul 2020 12:04:34 PM UTC, comment #4: 

> Give a try to the Ripple20 script and try to run it on a LwIP V1 and V2 device if possible.


Yes, you can do that if you want. Please share the results if you do.

Note that I don't expect for something to come out of this. I guess our fuzz tests already have discovered many of these length check issues.

Simon Goldschmidt <goldsimon>
Project Administrator
Wed 08 Jul 2020 08:25:09 AM UTC, comment #3: 

> But if you have more details at hand, feel free to support us in checking if these issues exist in lwIP.


Unfortunately I lack the technical background and implementation details concerning the LwIP stack. I encountered some script that might reveal if your product is affected by some / all of the Ripple20 vulnerabilities (https://github.com/corelight/ripple20) but I'm not sure if that can be run as easily on devices that don't run the Treck stack.

Well most of the 19 vulnerabilities had "improper handling of length parameter - cwe id 130" and "improper input validation - cwe id 20" as their common cwe (common weakness enumeration). The vulnerabilities with cwe id 130 seemed to be the most severe ones (all of them having a security severity score above 9 according to CVSS which is defined as "likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." according to CVSS.

We'd have different possibilities here:

Reassure that LwIP does have a decent amount of test cases for those common weaknesses (20 and 130 - input validation of length and input data).

Give a try to the Ripple20 script and try to run it on a LwIP V1 and V2 device if possible.

Subhan Waizi <swaizi>
Tue 07 Jul 2020 08:12:21 PM UTC, comment #2: 

No, oh has not been tested. lwIP has complete different sources, so I'd be surprised to find a match. Plus I just don't have the time at the moment to check up the details of bugs in some other stack.

But if you have more details at hand, feel free to support us in checking if these issues exist in lwIP.

Simon Goldschmidt <goldsimon>
Project Administrator
Tue 07 Jul 2020 07:44:18 PM UTC, comment #1: 

This item has been reassigned from the project Savannah Administration support tracker to your tracker.

The original report is still available at support #110257

Following are the information included in the original report:

[field #0]                  Item ID: 110257

[field #1]                 Group ID: 5802

[field #2]              Open/Closed: Open

[field #3]                 Severity: 6 - Security

[field #4]                  Privacy: Public

[field #6]                    Votes: 1

[field #8]                         : Unknown support Field Display Type

[field #9]                 Category: Savannah trackers - bugs, tasks, etc.

[field #10]             Submitted by: swaizi

[field #11]              Assigned to: None

[field #12]             Submitted on: Mon 06 Jul 2020 02:22:36 AM MDT

[field #13]                  Summary: Treck Ripple20 Issues in LWIP

[field #14]      Original Submission: Has it been explicitly tested that Ripple20 vulnerabilities inside the Treck TCP / IP Stack are not exploitable inside LWIP V1 or V2 as well?

[field #16]               Item Group: None

[field #17]                   Status: None

[field #18]        Component Version: None

[field #19]         Operating System: None

[field #20]          Reproducibility: None

[field #21]               Size (loc): None

[field #22]            Fixed Release: None

[field #23]          Planned Release: None

[field #24]                   Effort: 0.00

[field #28]                 Priority: 5 - Normal

[field #31]         Percent Complete: 0%

[field #33]                  Release: None

[field #36]         Originator Email: swaizi@hilscher.com

[field #58]     Custom Select Box #1: None

[field #59]     Custom Select Box #2: None

[field #60]     Custom Select Box #3: None

[field #61]     Custom Select Box #4: None

[field #62]     Custom Select Box #5: None

[field #63]     Custom Select Box #6: None

[field #64]     Custom Select Box #7: None

[field #65]     Custom Select Box #8: None

[field #66]     Custom Select Box #9: None

[field #67]    Custom Select Box #10: None

Bob Proulx <rwp>
Tue 07 Jul 2020 07:44:18 PM UTC, original submission:  

Has it been explicitly tested that Ripple20 vulnerabilities inside the Treck TCP / IP Stack are not exploitable inside LWIP V1 or V2 as well?

Subhan Waizi <swaizi>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by swaizi (Voted in favor of this item)
  • -email is unavailable- added by swaizi (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-07-07 rwp Reassign itemSavannah Administration, sr #110257 => lwIP - A Lightweight TCP/IP stack, bug #58724

    Back to the top


    Powered by Savane 3.5