Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
6/1/2020
03:35 PM
50%
50%

26 IoT Flaws Enable Denial-of-Service Attacks, Privilege Escalation

Research details vulnerabilities in the Zephyr Real Time Operating Systems and MCUboot, both used in IoT devices and sensors.

Newly discovered vulnerabilities in Internet of Things (IoT) components could expose a range of connected devices to denial-of-service (DoS) attacks and privilege escalation, a researcher with NCC Group reports.

The report details 26 vulnerabilities in the Zephyr Real Time Operating Systems (RTOS), which is specifically designed for IoT applications, and MCUboot, an open source, hardware-independent bootloader seen as a "companion project" to Zephyr, said NCC Group technical director Jeremy Boone in a blog post on the research, which was conducted in January and February of 2020. 

Both of these components exist in a range of IoT sensors and devices including baby monitors, LEDs, smart wearables, and IoT wireless gateways. Zephyr RTOS is supported by several major vendors including Intel, NXP, Nordic Semiconductor, and Texas Instruments; it also supports a wide range of chipset architectures and development kits. 

NCC Group discovered 25 vulnerabilities affecting the Zephyr RTOS and one affecting MCUboot. Researchers found both locally and remotely exploitable memory corruption flaws, multiple paths that could let a compromised user application to escalate privilege to kernel mode, and multiple weaknesses in the design of certain exploit mitigation systems that exist in the kernel.

As of the research publication date, 15 of these 26 problems have been addressed.

"The remaining unpatched findings pose a low overall risk as they represent denial of service vulnerabilities, or opportunities to further harden the kernel by improving existing exploit mitigation systems," the report states. Zephyr has indicated to NCC Group that these lower-risk issues are outside the 90-day embargo policy and they will address them in a future release. 

Read more details and download the full findings here.

 
 
 
 
 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register
Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd
CVE-2020-12525
PUBLISHED: 2021-01-22
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
CVE-2020-12511
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.