CVE-2020-22283: 
Linux Debian vulnerability analysis and mitigation

A buffer overflow vulnerability was identified in the icmp6sendresponsewithaddrsandnetif() function of Free Software Foundation lwIP version git head. This vulnerability allows attackers to access sensitive information through a crafted ICMPv6 packet (NVD, CVE Mitre).

The vulnerability exists in the implementation of ICMPv6 packet handling where the function pbuftakeat() incorrectly uses p->totlen instead of p->len as the length parameter. When p->totlen is larger than the length of p->payload, it can lead to memory disclosure. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with no required privileges or user interaction (Savannah Bug, NVD).

The exploitation of this vulnerability can lead to unauthorized access to sensitive information through memory disclosure when processing crafted ICMPv6 packets (Debian Advisory).

The vulnerability has been fixed in multiple versions across different distributions. Debian 10 (Buster) users should upgrade to version 2.0.3-3+deb10u2. The fix involves correcting the length parameter in the icmp6sendresponsewithaddrsandnetif() function. The patch is available in the upstream repository through multiple commits (Debian Advisory, Savannah Bug).