CVE-2022-39836

published 2022-10-25

CVE-2022-39836: An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that…

Priority P4 18 medium 5.5 CVSS 3.1

AV L AC L PR N UI R S U C N I N A H

An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
covesa	dlt-daemon	>= 0 < 2.18.9-1	2.18.9-1
covesa	dlt-daemon	>= 0 < 2.18.9-1	2.18.9-1
debian	dlt-daemon	< dlt-daemon 2.18.9-1 (forky)	dlt-daemon 2.18.9-1 (forky)
genivi	diagnostic_log_and_trace	<= 2.18.8	—

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-125