CVE-2020-16985

FAQ

Azure Sphere is running on IoT devices in my environment. How do I know if any of those devices are affected by this vulnerability?

An IoT device that is running Azure Sphere and is connected to a network is automatically updated every day. This vulnerability has already been addressed so the devices are protected from this vulnerability.

What type of information could be disclosed by this vulnerability?

The type of information that could be disclosed if an attacker successfully exploited this vulnerability is unauthorized file system access - reading from the file system.

This is the first time that a CVE has been issued against Azure Sphere. Why is that?

The Azure Sphere and MSRC bounty team completed a three-month security research challenge, in which we invited researchers to find and report vulnerabilities in the Azure Sphere OS. We appreciate all of the hard work of the researchers, and will be opening up several CVEs to record and reflect this work. More information on the challenge can be found here.

What version of Azure Sphere has the update that protects from this vulnerability?

All versions of Azure Sphere that are 20.09 and higher are protected from this vulnerability.

How do I ensure my Azure Sphere device has the update?

If your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 20.09 has been installed using the Azure Sphere CLI command:

azsphere device show-os-version

If the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command:

azsphere device show-deployment-status