CVE-2022-3409: Unauthenticated out of bounds stack write in bmcweb
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipartparser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipartparser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-3409.
What is the title of this vulnerability?
The title of this vulnerability is 'A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service'.
What is the severity level of CVE-2022-3409?
The severity level of CVE-2022-3409 is high, with a severity value of 7.5.
Which software is affected by CVE-2022-3409?
The OpenBMC Project's bmcweb software is affected by CVE-2022-3409.
How can CVE-2022-3409 be mitigated?
Mitigation for CVE-2022-3409 can be achieved by updating the OpenBMC Project's bmcweb software to a version above 2.13.0.