CVE-2022-39836: Medium severity genivi alliance dlt-daemon vulnerability
Published Oct 24, 2022
·Updated
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
Affected Software
1 affected component
GENIVI Diagnostic Log and Trace<=2.18.8
Remediation
Patch Available
Event History
Oct 24, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Oct 25, 2022
Data Sourced
via NVD·05:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-39836?
The severity of CVE-2022-39836 is classified as medium due to the potential for process crashes.
2
How do I fix CVE-2022-39836?
To fix CVE-2022-39836, update the dlt-daemon to version 2.18.9 or later.
3
What type of vulnerability is CVE-2022-39836?
CVE-2022-39836 is a heap-based buffer over-read vulnerability triggered by a faulty DLT file parser.
4
Which software versions are affected by CVE-2022-39836?
CVE-2022-39836 affects dlt-daemon versions up to and including 2.18.8.
5
What can attackers achieve with CVE-2022-39836?
Attackers can crash the dlt-daemon process by exploiting the vulnerability with a specially crafted DLT file.