Covesa
Monthly
Stack memory disclosure in COVESA Open1722 through version 0.9.2 exposes approximately 18 KB of live process stack memory onto the CAN bus, reachable by any node on that bus. An unauthenticated remote attacker sends a crafted UDP datagram bearing a matching AVTP stream ID; integer truncation in acf-can-listener.c converts avtp_to_can()'s -1 error return to 255 in a uint8_t variable, driving the write loop 255 times over a 15-slot stack array and emitting roughly 240 CAN frames of raw stack contents. No public exploit identified at time of analysis and no CISA KEV listing is present, but the vulnerability mechanism is fully described in the VulnCheck advisory, lowering the barrier to reproduction.
Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack memory and achieve arbitrary code execution or denial of service by sending a single crafted UDP datagram containing more than 15 ACF-CAN messages. The root cause is an unbounded write index in the avtp_to_can() function, which increments unconditionally past the end of a fixed 15-slot stack array without comparing against the caller-supplied size. Exploitation requires no authentication because the ACF-CAN listener accepts packets from any sender matching a hardcoded stream identifier transmitted in plaintext; no public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stack memory disclosure in COVESA Open1722 through version 0.9.2 exposes approximately 18 KB of live process stack memory onto the CAN bus, reachable by any node on that bus. An unauthenticated remote attacker sends a crafted UDP datagram bearing a matching AVTP stream ID; integer truncation in acf-can-listener.c converts avtp_to_can()'s -1 error return to 255 in a uint8_t variable, driving the write loop 255 times over a 15-slot stack array and emitting roughly 240 CAN frames of raw stack contents. No public exploit identified at time of analysis and no CISA KEV listing is present, but the vulnerability mechanism is fully described in the VulnCheck advisory, lowering the barrier to reproduction.
Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack memory and achieve arbitrary code execution or denial of service by sending a single crafted UDP datagram containing more than 15 ACF-CAN messages. The root cause is an unbounded write index in the avtp_to_can() function, which increments unconditionally past the end of a fixed 15-slot stack array without comparing against the caller-supplied size. Exploitation requires no authentication because the ACF-CAN listener accepts packets from any sender matching a hardcoded stream identifier transmitted in plaintext; no public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.