CVE-2020-13987: 
NixOS vulnerability analysis and mitigation

An Out-of-Bounds Read vulnerability (CVE-2020-13987) exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c. This vulnerability affects Contiki through version 3.0 and open-iscsi through version 2.1.12 (MITRE CVE, NVD).

The vulnerability occurs in the function that parses incoming transport layer packets (TCP/UDP) where it does not check the length fields of packet headers against the data available in the packets. Given arbitrary lengths, an out-of-bounds memory read may be performed during the checksum computation (CISA Advisory, CERT VU).

Successful exploitation of this vulnerability could allow attackers to perform out-of-bounds memory reads during checksum computation, potentially leading to information disclosure or denial of service conditions (CISA Advisory).

The vulnerability has a CVSS v3 base score of 8.2 (High), with the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction (CERT VU).

For open-iscsi, users should update to version 2.1.12 or later. Since uIP is end-of-life (EOL), users should migrate to supported alternatives. Organizations should minimize network exposure for affected systems, ensure they are not accessible from the Internet, and locate control system networks behind firewalls (CISA Advisory).