Researchers discovered 19 new zero-day vulnerabilities in a TCP/IP software library developed by Treck. Dubbed Ripple20, the batch includes CVE-2020-11901, which has the potential to take control of an internet-connected device.
Background
The JSOF research lab, a group of researchers who focus on low-level software vulnerabilities, disclosed 19 vulnerabilities they’ve named “Ripple20.” The batch affects an embedded Internet of Things (IoT) TCP/IP software library developed by Treck Inc., a developer for embedded internet protocols. This library is found in a wide array of devices from over 70 hardware vendors. When exploited, these vulnerabilities could lead to device takeover and allow an attacker to pivot from affected devices to other critical infrastructure. These vulnerabilities follow the disclosure of CVE-2020-10136, an IP-in-IP packet processing vulnerability disclosed earlier this month, which also affects IoT device TCP/IP libraries developed by Treck. Ripple20 also echoes multi-vulnerability disclosures like URGENT/11, which has continued to widen in impact over time.
Analysis
The Ripple20 vulnerabilities exist within the embedded TCP/IP software libraries developed by Treck. These libraries are licensed and used by a broad spectrum of devices manufactured by a number of vendors. JSOF notes that tracking and identifying all of the potentially affected vendors and devices is difficult for both logistical and legal reasons. Their disclosure details just how difficult it was to identify the affected supply chain, as the scope of potential risks was diverse and vast.
CVE-2020-11901 is a DNS vulnerability that would allow an attacker to obtain remote code execution (RCE) on devices redirected to a malicious web address. An attacker would first need to hijack the device’s hostname resolution by either poisoning its DNS server, or spoofing an otherwise legitimate IP address like a device update server. Standard security configurations often allow outbound connections to have fewer restrictions than inbound ones, allowing exploitation of these vulnerabilities to have a larger potential impact.
CVE-2020-11896 and CVE-2020-11897 are vulnerabilities caused by malformed packets being sent to a device that has IP tunneling enabled. JSOF confirmed CVE-2020-11896 on a Digi Connect ME 9210 by sending malformed ICMP echo requests, which allowed JSOF to inject shellcode on the device. An attacker could either obtain consistent RCEs on vulnerable devices, or cause a denial of service (DoS) until the device is reset.
The remainder of the vulnerabilities outlined in the disclosure range from RCE to sensitive information disclosure, creating a wide breadth of risks for unmitigated and unpatched devices.
A full list of CVEs can be found in the table below:
| CVE ID | CVSSv3* | Potential Impact |
|---|---|---|
| CVE-2020-11896 | 10 | Remote Code Execution |
| CVE-2020-11897 | 10 | Out-of-Bounds Write |
| CVE-2020-11901 | 9 | Remote Code Execution |
| CVE-2020-11898 | 9.1 | Exposure of Sensitive Information |
| CVE-2020-11900 | 8.2 | Use After Free |
| CVE-2020-11902 | 7.3 | Out-of-bounds Read |
| CVE-2020-11904 | 5.6 | Out-of-Bounds Write |
| CVE-2020-11899 | 5.4 | Out-of-bounds Read |
| CVE-2020-11903 | 5.3 | Exposure of Sensitive Information |
| CVE-2020-11905 | 5.3 | Exposure of Sensitive Information |
| CVE-2020-11906 | 5 | Integer Underflow |
| CVE-2020-11907 | 5 | Integer Underflow |
| CVE-2020-11909 | 3.7 | Integer Underflow |
| CVE-2020-11910 | 3.7 | Out-of-bounds Read |
| CVE-2020-11911 | 3.7 | Incorrect Permission Assignment for Critical Resource |
| CVE-2020-11912 | 3.7 | Out-of-bounds Read |
| CVE-2020-11913 | 3.7 | Out-of-bounds Read |
| CVE-2020-11914 | 3.1 | Out-of-bounds Read |
| CVE-2020-11908 | 3.1 | Exposure of Sensitive Information |
*CVSSv3 Scores were provided by JSOF and may be subject to change
Proof of concept
JSOF has posted a Proof of Concept video to their YouTube channel demonstrating an attack:
Vendor response
Since September 2019, JSOF, Treck, CERT organizations and security vendors have been working together with hardware vendors to confirm affected devices. Confirming all of the affected devices will take considerable continued effort and time. JSOF has a live list of affected vendors that can be found in the technical section of the disclosure page.
Solution
Users are encouraged to reach out to their device vendors for support and updates if available. For devices that are no longer supported by their manufacturer, users can either upgrade to a supported device, or apply the recommended mitigation steps. Vendors that have already released updates include HP, Bosch, Braun, Caterpillar, GHS and Rockwell.
Users can also potentially mitigate attacks by a multitude of security practices. JSOF provides a list on the disclosure page of potential mitigation options.
Identifying affected systems
A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.
Get more information
- Ripple20 Disclosure Page
- HP Advisory Page
- Bosch Advisory Page
- Braun Advisory Page
- Caterpillar Advisory Page
- GHS Advisory Page
- Rockwell Advisory Page
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.