Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00339.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Beckhoff TwinCat Driver for Intel 8254x (Tcl8254x.sys) affected
Version Status Constraints
unspecified affected ≤ 3.1.0.3603 for TwinCAT 3.1 4024
unspecified affected ≤ 3.1.0.3512 for TwinCAT 3.1 4022
unspecified affected ≤ 2.11.0.2120 for TwinCAT 2.11 2350
Beckhoff TwinCat Driver for Intel 8255x (Tcl8255x.sys) affected
Version Status Constraints
unspecified affected ≤ 3.1.0.3600 for TwinCAT 3.1 4024
unspecified affected ≤ 3.1.0.3500 for TwinCAT 3.1 4024
unspecified affected ≤ 2.11.0.2117 for TwinCAT 2.11 2350

Configuration 1 [-]

AND
cpe:2.3:a:beckhoff:twincat_driver:*:*:*:*:*:*:*:*
cpe:2.3:a:beckhoff:twincat:3.1:build_4024:*:*:*:*:*:*
OR cpe:2.3:h:intel:82540em:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82540ep:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541ei:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541er:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541gi:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541pi:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82544ei:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82544gc:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82545em:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82545gm:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82546eb:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82546gb:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82547ei:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82547gi:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*
cpe:2.3:a:beckhoff:twincat:3.1:build_4022:*:*:*:*:*:*
OR cpe:2.3:h:intel:82540em:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82540ep:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541ei:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541er:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541gi:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541pi:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82544ei:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82544gc:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82545em:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82545gm:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82546eb:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82546gb:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82547ei_:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82547gi:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*
cpe:2.3:a:beckhoff:twincat:2.11:build_2350:*:*:*:*:*:*
OR cpe:2.3:h:intel:82540em:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82540ep:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541ei:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541er:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541gi:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82541pi:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82544ei:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82544gc:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82545em:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82545gm:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82546eb:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82546gb:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82547ei_:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82547gi:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*
cpe:2.3:a:beckhoff:twincat:3.1:build_402:*:*:*:*:*:*
OR cpe:2.3:h:intel:82557:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82558:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82559:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND
cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*
cpe:2.3:a:beckhoff:twincat:3.1:build_4024:*:*:*:*:*:*
OR cpe:2.3:h:intel:82557:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82558:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82559:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND
cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*
cpe:2.3:a:beckhoff:twincat:2.11:build_2350:*:*:*:*:*:*
OR cpe:2.3:h:intel:82557:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82558:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:82559:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Beckhoff Subscribe
Twincat Subscribe
Twincat Driver Subscribe
Intel Subscribe
82540em Subscribe
82540ep Subscribe
82541ei Subscribe
82541er Subscribe
82541gi Subscribe
82541pi Subscribe
82544ei Subscribe
82544gc Subscribe
82545em Subscribe
82545gm Subscribe
82546eb Subscribe
82546gb Subscribe
82547ei Subscribe
82547ei Subscribe
82547gi Subscribe
82557 Subscribe
82558 Subscribe
82559 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2020-4796 Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device.
Fixes

Solution

No solution given by the vendor.

Workaround

If no real-time communication from TwinCAT is required on the Ethernet interface, then users can alternatively re-configure them to use the Intel ® driver, which is shipped with Beckhoff images. Customers should configure a perimeter firewall to block traffic from untrusted networks to the device, especially regarding ICMP and other small ethernet frames. Beckhoff offers software patches for TwinCAT 3.1 and TwinCAT 2.11 on request. These patches will be included in the the next regular releases to the affected software versions. The advisory will be updated upon availability.

References
Link Providers
https://cert.vde.com/en-us/advisories/vde-2020-019 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published:

Updated: 2024-08-04T11:56:52.090Z

Reserved: 2020-04-30T00:00:00

Link: CVE-2020-12494

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-06-16T14:15:10.977

Modified: 2024-11-21T04:59:47.893

Link: CVE-2020-12494

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses