CVE-2019-12265:

Memory leak in the IGMPv3 client component of the Wind River VxWorks IPNET stack (versions 6.5–6.9.4) leading to potential information leak via IGMPv3 membership reports.

Score
A numerical rating that indicates how dangerous this vulnerability is.

5.3Medium

Published Date:Aug 9, 2019
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:12.9
EPSS Percentile:94%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:1.4
Confidentiality Impact:LOW
Integrity Impact:NONE
Availability Impact:NONE

Description Preview

Memory leak in the IGMPv3 client component of the Wind River VxWorks IPNET stack (versions 6.5–6.9.4) leading to potential information leak via IGMPv3 membership reports.

Overview

Wind River VxWorks versions 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 contain a memory leak in the IGMPv3 client portion of the IPNET stack, resulting in an information leak via IGMPv3 membership reports. This vulnerability can lead to memory exhaustion and degraded system availability or inadvertent exposure of information through IGMP traffic.

Remediation

Apply the vendor-provided patch or firmware update that fixes the IGMPv3/IPNET memory leak (e.g., the Wind River IPNET urgent11 update). Verify patch applicability for your VxWorks version and install it on affected devices.
If an official patch is not yet available, implement mitigations:
Disable IGMPv3 or limit IGMPv3 functionality on devices where it is not required.
Restrict IGMP traffic to trusted network segments and apply strict firewall/ACL rules to control multicast traffic.
Segment networks to limit exposure of IGMP traffic to impacted devices.
Monitor memory usage and enable relevant logging to detect unusual IGMP activity or memory growth.
Validate remediation with testing in a controlled environment and recheck that the patch version is active on all affected systems.
Maintain an inventory of affected devices and track vendor advisories for new updates or further mitigations.