CVE-2022-39836
MEDIUMdiagnostic_log_and_trace < 2.18.8 - Heap-Based Buffer Over-Read via DLT File Parser
Title source: llmDescription
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
References (3)
Core 3
Core References
Exploit, Patch, Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/multiple-memory-corruption-vulnerabilities-in-covesa-dlt-daemon/
Exploit, Mailing List, Patch, Third Party Advisory
https://seclists.org/fulldisclosure/2022/Sep/24
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2024/06/msg00021.html
Scores
CVSS v3
5.5
EPSS
0.0042
EPSS Percentile
33.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-125
Status
published
Products (1)
genivi/diagnostic_log_and_trace
< 2.18.8
Published
Oct 25, 2022
Tracked Since
Feb 18, 2026