CVE-2020-22284: 
Linux Debian vulnerability analysis and mitigation

A buffer overflow vulnerability was discovered in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2. The vulnerability was disclosed in June 2020 and affects the 6LoWPAN implementation in lwIP. This security flaw allows attackers to access sensitive information through crafted 6LoWPAN packets (NVD).

The vulnerability exists in the zepiflinkoutput() function where it attempts to parse a 6LoWPAN TX packet as UDP broadcast. The issue occurs when calling pbuftakeat() with incorrect parameters. Specifically, p->totlen is used, which represents the total length of p->payload and all following pbuf payloads lengths. If p->tot_len is larger than p->payload length, memory disclosure can occur. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD, Savannah Bug).

When exploited, this vulnerability allows attackers to access sensitive information via crafted 6LoWPAN packets. The high CVSS score indicates significant potential for unauthorized information disclosure, though integrity and availability are not affected (NVD).

The vulnerability has been fixed in a patch released on July 3, 2020. The fix is available in commit 8363c24e45a32728e385cfc2c3c36d88a8a9e70b of the lwIP repository (Savannah Bug).