CVE-2020-13988: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-13988 is a security vulnerability discovered in Contiki through version 3.0. The vulnerability exists in the uIP TCP/IP Stack component, specifically when parsing TCP MSS options of IPv4 network packets in uip_process function located in net/ipv4/uip.c. This vulnerability was disclosed in December 2020 and affects multiple embedded TCP/IP stacks (CISA Advisory).

The vulnerability is classified as an Integer Overflow (CWE-190) in the function that parses the TCP MSS option. The function in open-iscsi, uIP-Contiki-OS, and uIP does not check the validity of the length field of this option, which can lead to unexpected behavior. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability allows an attacker to force the system into an infinite loop when arbitrary TCP MSS values are supplied. This can result in a denial of service condition, affecting the availability of the affected system (CERT VU).

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. The attack vector is network-based, allowing attackers to exploit the vulnerability by sending specially crafted network packets to the target system (CISA Advisory).

For affected systems, CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the Internet. Users should locate control system networks and remote devices behind firewalls and isolate them from the business network. When remote access is required, secure methods such as VPNs should be used. The maintainers of open-iscsi recommend users update to the latest version (CISA Advisory).