Cloudanix VulnDB

CVE-2019-12265

Medium · 5.3

CVSS

5.3

EPSS

59.8%

Published

Aug 9, 2019

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Attend

A flaw in certain network software can let attackers see pieces of memory they should not, potentially revealing private data from devices.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak in the IGMPv3 client component allows disclosure of memory contents via crafted IGMPv3 membership reports.

Why it matters to the business

Sensitive information from embedded network devices may be exposed, raising operational risk and potential compliance issues in affected deployments.

How an attack unfolds

An attacker on the local network sends specially crafted IGMPv3 packets that trigger the memory leak, causing the target to include internal memory fragments in its responses.

How to fix it

Upgrade affected packages to the listed fixed versions such as elfutils 0.176-r0 on Alpine v3.12 through v3.20; apply vendor patches for VxWorks IGMPv3 component where available.

How to confirm the fix worked

Confirm package versions match fixed releases; test IGMPv3 handling to verify no memory disclosure occurs in responses.

Typical attack path

  1. Identify reachable VxWorks devices supporting IGMPv3
  2. Craft and send IGMPv3 membership report packets
  3. Capture responses containing leaked memory data
  4. Analyze captured data for sensitive information

How to detect it

Inspect network logs and packet captures for unusual IGMPv3 membership reports; look for repeated queries followed by oversized responses containing unexpected data.

What your security team should do

  • Prioritize patching or upgrading all listed elfutils packages immediately due to high EPSS score
  • Monitor network traffic for anomalous IGMPv3 packets
  • Review device configurations to disable unnecessary IGMPv3 if possible

The record

Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities