High severity · published May 11, 2020
CVE-2020-10067
A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption resulting in code execution within the kernel. See NCC-ZEP-005 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
Zephyr · Zephyrproject
1.14.1; 2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10067
docs.zephyrproject.org
https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10067
Patch
https://github.com/zephyrproject-rtos/zephyr/pull/23239
Patch
https://github.com/zephyrproject-rtos/zephyr/pull/23653
Patch
https://github.com/zephyrproject-rtos/zephyr/pull/23654
Third Party Advisory
https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-27
More from Zephyr
10.0
CVE-2023-4260
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system
9.8
CVE-2026-13214
Stack buffer overflow in OCPP GetConfiguration key parsing
9.8
CVE-2026-10666
Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`
9.8
CVE-2026-5067
Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
9.8
CVE-2026-1678
dns: memory‑safety issue in the DNS name parser