CVE-2019-12256:

Wind River VxWorks 6.9 and vx7 contain a buffer overflow in the IPv4 IPNET stack, due to improper parsing of IPv4 packet IP options.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Aug 9, 2019
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:13.8
EPSS Percentile:94%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Wind River VxWorks 6.9 and vx7 contain a buffer overflow in the IPv4 IPNET stack, due to improper parsing of IPv4 packet IP options.

Overview

This CVE covers a buffer overflow in the IPv4 IPNET stack of Wind River VxWorks 6.9 and vx7 arising from unsafe handling of IPv4 options during packet parsing. The vulnerability can be exploited by sending crafted IPv4 traffic to affected systems, which may lead to a crash or other instability. Vendor advisories and patches have been issued to address the issue, and affected deployments should apply the recommended updates or mitigations to reduce risk.

Remediation

Confirm affected systems: Verify you are running Wind River VxWorks 6.9 or vx7 and that the IPNET IPv4 stack is in use.
Apply vendor patch/update: Install the official security fix from Wind River (reference: IPNET urgent11 and related advisories) or upgrade to a version released with the CVE-2019-12256 fix. Follow Wind River’s instructions for applying the patch to your specific hardware and build.
If immediate patching is not possible: implement compensating controls to limit exposure, such as:
Place affected devices behind a trusted network perimeter and restrict IPv4 traffic to essential sources.
Deploy network firewall/IPS rules to drop or filter crafted IPv4 packets containing unusual or suspicious IP options before they reach the IPNET stack.
Enable ingress filtering and network segmentation to minimize uncontrolled exposure to IPv4 traffic.
Verification and monitoring: After patching or applying mitigations, verify the fix with vendor guidance and perform a vulnerability check or scanner against CVE-2019-12256. Monitor vendor advisories for any follow-up advisories or additional fixes.
Ongoing maintenance: Establish a process to monitor and apply future IPNET/IP stack security updates and maintain an updated inventory of affected devices.