What is the CVSS score of CVE-2024-32482?

CVE-2024-32482 has a CVSS 3.1 base score of 2.2 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

RAM CVE-2024-32482

LOW

Out-of-bounds Read (CWE-125)

2024-04-23 security-advisories@github.com

Buffer Overflow Information Disclosure

2.2

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

2.2 LOW

AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 23, 2024 - 18:15 cve.org

LOW 2.2

DescriptionCVE.org

The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available.

AnalysisAI

The Tillitis TKey signer device application is an ed25519 signing tool. Rated low severity (CVSS 2.2). No vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Read (CWE-125), which allows attackers to read data from memory outside the intended buffer boundaries. The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available. Version information: version 1.0.0.

Affected ProductsAI

RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate array indices and buffer lengths. Use memory-safe languages. Enable AddressSanitizer during testing.