buglwIP - A Lightweight TCP/IP stack - Bugs: bug #58724, Treck Ripple20 Issues in LWIP

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58724: Treck Ripple20 Issues in LWIP

Submitter:  Subhan Waizi <swaizi>
Submitted:  Tue 07 Jul 2020 07:44:18 PM UTC
   
 
Category:  None Severity:  6 - Security
Item Group:  None Status:  Invalid
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  Other

Thu 04 Mar 2021 09:01:25 PM UTC, comment #5: 

As stated before: our sources are different plus we do have extensive fuzz testing. Please reopen if you still find we do have these issues.

Simon Goldschmidt <goldsimon>
Group administrator
Wed 08 Jul 2020 12:04:34 PM UTC, comment #4: 


> Give a try to the Ripple20 script and try to run it on a LwIP V1 and V2 device if possible.


Yes, you can do that if you want. Please share the results if you do.

Note that I don't expect for something to come out of this. I guess our fuzz tests already have discovered many of these length check issues.

Simon Goldschmidt <goldsimon>
Group administrator
Wed 08 Jul 2020 08:25:09 AM UTC, comment #3: 


> But if you have more details at hand, feel free to support us in checking if these issues exist in lwIP.


Unfortunately I lack the technical background and implementation details concerning the LwIP stack. I encountered some script that might reveal if your product is affected by some / all of the Ripple20 vulnerabilities (https://github.com/corelight/ripple20) but I'm not sure if that can be run as easily on devices that don't run the Treck stack.

Well most of the 19 vulnerabilities had "improper handling of length parameter - cwe id 130" and "improper input validation - cwe id 20" as their common cwe (common weakness enumeration). The vulnerabilities with cwe id 130 seemed to be the most severe ones (all of them having a security severity score above 9 according to CVSS which is defined as "likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." according to CVSS.

We'd have different possibilities here:

Reassure that LwIP does have a decent amount of test cases for those common weaknesses (20 and 130 - input validation of length and input data).

Give a try to the Ripple20 script and try to run it on a LwIP V1 and V2 device if possible.

Subhan Waizi <swaizi>
Tue 07 Jul 2020 08:12:21 PM UTC, comment #2: 

No, oh has not been tested. lwIP has complete different sources, so I'd be surprised to find a match. Plus I just don't have the time at the moment to check up the details of bugs in some other stack.

But if you have more details at hand, feel free to support us in checking if these issues exist in lwIP.

Simon Goldschmidt <goldsimon>
Group administrator
Tue 07 Jul 2020 07:44:18 PM UTC, comment #1: 

This item has been reassigned from the project Savannah Administration support tracker to your tracker.

The original report is still available at support #110257

Following are the information included in the original report:

[field #0]                  Item ID: 110257

[field #1]                 Group ID: 5802

[field #2]              Open/Closed: Open

[field #3]                 Severity: 6 - Security

[field #4]                  Privacy: Public

[field #6]                    Votes: 1

[field #8]                         : Unknown support Field Display Type

[field #9]                 Category: Savannah trackers - bugs, tasks, etc.

[field #10]             Submitted by: swaizi

[field #11]              Assigned to: None

[field #12]             Submitted on: Mon 06 Jul 2020 02:22:36 AM MDT

[field #13]                  Summary: Treck Ripple20 Issues in LWIP

[field #14]      Original Submission: Has it been explicitly tested that Ripple20 vulnerabilities inside the Treck TCP / IP Stack are not exploitable inside LWIP V1 or V2 as well?

[field #16]               Item Group: None

[field #17]                   Status: None

[field #18]        Component Version: None

[field #19]         Operating System: None

[field #20]          Reproducibility: None

[field #21]               Size (loc): None

[field #22]            Fixed Release: None

[field #23]          Planned Release: None

[field #24]                   Effort: 0.00

[field #28]                 Priority: 5 - Normal

[field #31]         Percent Complete: 0%

[field #33]                  Release: None

[field #36]         Originator Email: swaizi@hilscher.com

[field #58]     Custom Select Box #1: None

[field #59]     Custom Select Box #2: None

[field #60]     Custom Select Box #3: None

[field #61]     Custom Select Box #4: None

[field #62]     Custom Select Box #5: None

[field #63]     Custom Select Box #6: None

[field #64]     Custom Select Box #7: None

[field #65]     Custom Select Box #8: None

[field #66]     Custom Select Box #9: None

[field #67]    Custom Select Box #10: None


Bob Proulx <rwp>
Tue 07 Jul 2020 07:44:18 PM UTC, original submission:  

Has it been explicitly tested that Ripple20 vulnerabilities inside the Treck TCP / IP Stack are not exploitable inside LWIP V1 or V2 as well?

Subhan Waizi <swaizi>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by swaizi (Voted in favor of this item)
  • -email is unavailable- added by swaizi (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-03-04 goldsimon StatusNone Invalid
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2020-07-07 rwp Reassign itemSavannah Administration, sr #110257 lwIP - A Lightweight TCP/IP stack, bug #58724

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code