CVE-2020-29394: A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows arbitrary code…

PriorityP339high7.8CVSS 3.1

AVLACLPRNUIRSUCHIHAH

EPSS

1.86%

77.1th percentile

A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows arbitrary code execution because fscanf is misused (no limit on the number of characters to be read in the format argument).

Affected

7 ranges

Vendor	Product	Version range	Fixed in
covesa	dlt-daemon	>= 0 < 2.18.5-0.3	2.18.5-0.3
covesa	dlt-daemon	>= 0 < 2.18.5-0.3	2.18.5-0.3
covesa	dlt-daemon	>= 0 < 2.18.5-0.3	2.18.5-0.3
covesa	dlt-daemon	>= 0 < 2.18.5-0.3	2.18.5-0.3
debian	debian_linux	—	—
debian	dlt-daemon	< dlt-daemon 2.18.5-0.3 (bookworm)	dlt-daemon 2.18.5-0.3 (bookworm)
genivi	diagnostic_log_and_trace	<= 2.18.5	—

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

osv7.8HIGH

vendor_debian7.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.