^{CVE-2019-12256:}Wind River VxWorks 6.9 and vx7 contain a buffer overflow in the IPv4 IPNET stack, due to improper parsing of IPv4 packet IP options.

Overview

This CVE covers a buffer overflow in the IPv4 IPNET stack of Wind River VxWorks 6.9 and vx7 arising from unsafe handling of IPv4 options during packet parsing. The vulnerability can be exploited by sending crafted IPv4 traffic to affected systems, which may lead to a crash or other instability. Vendor advisories and patches have been issued to address the issue, and affected deployments should apply the recommended updates or mitigations to reduce risk.

Remediation

• Confirm affected systems: Verify you are running Wind River VxWorks 6.9 or vx7 and that the IPNET IPv4 stack is in use.
• Apply vendor patch/update: Install the official security fix from Wind River (reference: IPNET urgent11 and related advisories) or upgrade to a version released with the CVE-2019-12256 fix. Follow Wind River’s instructions for applying the patch to your specific hardware and build.
• If immediate patching is not possible: implement compensating controls to limit exposure, such as:
  • Place affected devices behind a trusted network perimeter and restrict IPv4 traffic to essential sources.
  • Deploy network firewall/IPS rules to drop or filter crafted IPv4 packets containing unusual or suspicious IP options before they reach the IPNET stack.
  • Enable ingress filtering and network segmentation to minimize uncontrolled exposure to IPv4 traffic.
• Verification and monitoring: After patching or applying mitigations, verify the fix with vendor guidance and perform a vulnerability check or scanner against CVE-2019-12256. Monitor vendor advisories for any follow-up advisories or additional fixes.
• Ongoing maintenance: Establish a process to monitor and apply future IPNET/IP stack security updates and maintain an updated inventory of affected devices.

References

• Wind River advisory and security notices: https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/
• Wind River CVE page for CVE-2019-12256: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12256
• SonicWall PSIRT vulnerability detail: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009
• Siemens SSA-632562 product certificate: https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
• NetApp advisory NTAP-20190802-0001: https://security.netapp.com/advisory/ntap-20190802-0001/
• F5 support article: https://support.f5.com/csp/article/K41190253
• Siemens SSA-189842 product certificate: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
• Siemens SSA-352504 product certificate: https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf
• Wind River security notices (overview): https://support2.windriver.com/index.php?page=security-notices