EUVD-2026-36664
GHSA-36r7-c6f4-gj9g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:X
Network-reachable via DoIP with no authentication (PR:N); OOB read yields limited memory disclosure (C:L); reliable crash of UDS server (A:H); no integrity impact; scope stays within the server process (S:U).
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess() function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. The handler reads the SecurityAccess subFunction from recv_buf[1] without first checking that recv_len is at least 2, then computes the key-data length as the unsigned subtraction (uint16_t)(recv_len - UDS_0X27_REQ_BASE_LEN); when recv_len equals 1 the result underflows to 65535 and is passed as args.len to the application's SecAccessValidateKey or SecAccessRequestSeed callback, which typically iterates or copies that many bytes from the 4-KB receive buffer. Every other UDS sub-function handler in the library (0x10, 0x11, 0x14, 0x19, 0x22, 0x23, 0x28, and others) performs an explicit recv_len lower-bound check before indexing; Handle_0x27_SecurityAccess is the sole outlier. The vulnerable handler reaches over CAN bus, OBD-II, ISO-TP, and DoIP transports and is exposed in the default diagnostic session without prior authentication; deployments on automotive ECUs, industrial controllers, and IoT devices that ship iso14229 as their UDS server are affected.
AnalysisAI
Integer underflow and out-of-bounds read in driftregion iso14229 through version 0.9.0 allows remote unauthenticated attackers to crash a UDS server or read up to 65535 bytes of memory past the 4KB receive buffer by sending a single-byte 0x27 SecurityAccess diagnostic request. The Handle_0x27_SecurityAccess() function in iso14229.c at line 1447 fails to validate that recv_len is at least 2 before computing key-data length via unsigned subtraction, uniquely among all other sub-function handlers in the library. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates publicly available exploit code exists, and the vulnerability is exposed across CAN bus, OBD-II, ISO-TP, and DoIP transports in the default diagnostic session on automotive ECUs, industrial controllers, and IoT devices.
Technical ContextAI
iso14229 (CPE: cpe:2.3:a:driftregion:iso14229:*:*:*:*:*:*:*:*) is an open-source implementation of the ISO 14229 Unified Diagnostic Services (UDS) protocol, commonly embedded in automotive ECUs, industrial controllers, and IoT devices. UDS 0x27 SecurityAccess is a sub-service used to negotiate cryptographic seed-key authentication. The root cause is CWE-191 (Integer Underflow), which directly enables CWE-125 (Out-of-Bounds Read). Specifically, Handle_0x27_SecurityAccess() in iso14229.c reads recv_buf[1] to extract the SecurityAccess subFunction without first asserting recv_len >= 2. It then computes the key-data argument length as the unsigned 16-bit subtraction (uint16_t)(recv_len - UDS_0X27_REQ_BASE_LEN); when recv_len is 1, the result wraps to 65535. This value is forwarded as args.len to the application's SecAccessValidateKey or SecAccessRequestSeed callback, which typically iterates or copies that many bytes from the 4KB receive buffer - exposing up to 64KB of process memory or triggering a crash. Every other UDS sub-function handler in the library (0x10, 0x11, 0x14, 0x19, 0x22, 0x23, 0x28, and others) performs an explicit recv_len lower-bound check; Handle_0x27_SecurityAccess is the sole outlier, suggesting a missed code-review parity check during development.
RemediationAI
No vendor-released patch identified at time of analysis; the upstream fix version has not been independently confirmed from available references. Integrators should monitor https://github.com/driftregion/iso14229 for a release that adds an explicit recv_len >= 2 lower-bound check in Handle_0x27_SecurityAccess() consistent with all other sub-function handlers in the library. Until a patch is available, the most targeted compensating control is to add a transport-layer length filter that drops any 0x27 SecurityAccess request shorter than UDS_0X27_REQ_BASE_LEN (2 bytes) before it reaches the iso14229 handler; this eliminates the underflow condition without disabling the diagnostic service. If 0x27 SecurityAccess functionality is not operationally required, disabling SecurityAccess session support in the UDS server configuration removes the attack surface entirely - note this will break any key-based diagnostic authentication flows. On DoIP-accessible deployments, restricting diagnostic session access to known tester IP addresses or requiring VPN/network segmentation limits exposure from opportunistic attackers while preserving diagnostic workflows for authorized tools. OBD-II and CAN bus physically adjacent attack vectors are inherently lower risk but physical port locking on deployed ECUs should be considered for high-assurance environments.
Same weakness CWE-191 – Integer Underflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today