CVE-2018-16522

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Amazon Web Services (AWS) FreeRTOS through 1.3.1 has an uninitialized pointer free in SOCKETS_SetSockOpt.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-824

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/Exploit, Third Party Advisory
https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/Third Party Advisory
https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.mdRelease Notes, Third Party Advisory
https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/Exploit, Third Party Advisory
https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/Third Party Advisory
https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.mdRelease Notes, Third Party Advisory

Timeline

Published: Dec 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-165237.4Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP CVE-2018-165245.9Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP CVE-2018-165258.1Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP CVE-2018-165268.1Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP CVE-2018-165275.9Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP CVE-2018-165288.1Amazon Web Services (AWS) FreeRTOS through 1.3.1 allows remote attackers to execute arbitrary code because of mbedTLS context object corrupt CVE-2018-165299.8A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended CVE-2018-16535.4IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. This vulnerabil CVE-2018-165309.8A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a p CVE-2018-165395.5In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handl CVE-2018-16546.1IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using a CVE-2018-165407.8In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-f