CVE-2018-1000660
High
Description
TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vulnerability in Function get_package_name in the file kernel/src/tbfheader.rs, variable "pub package_name: &'static str," in the file process.rs that can result in A tock capsule (untrusted driver) could access arbitrary memory by using only safe code. This vulnerability appears to have been fixed in commit 42f7f36e74088036068d62253e1d8fb26605feed.
SeverityHigh
CVSS7.5
Exploit probability—
ProductTock
PublishedSep 6, 2018
First seenSep 6, 2018
How to fix
Update
- tockos tock1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tockos tock | v < 1.2 | 1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.