CVE-2020-28895 HIGH

CVE-2020-28895: integer overflow in calloc

Vendor N/A
Product n/a
Published February 3, 2021
Last update August 4, 2024

CVSS base score

7.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.

Key dates

02Disclosure timeline

February 3, 2021 CVE published
August 4, 2024 Record updated