Genivi Diagnostic Log And Trace vulnerabilities

6 known vulnerabilities affecting genivi/diagnostic_log_and_trace.

Total CVEs

6

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL1HIGH2MEDIUM3

Vulnerabilities

Page 1 of 1

CVE-2022-39837MEDIUMCVSS 5.5≤ 2.18.82022-10-25

CVE-2022-39837 [MEDIUM] CWE-476 CVE-2022-39837: An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Du An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,

CVE-2022-39836MEDIUMCVSS 5.5≤ 2.18.82022-10-25

CVE-2022-39836 [MEDIUM] CWE-125 CVE-2022-39836: An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Du An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.

CVE-2022-31291HIGHCVSS 7.5v2.18.82022-06-16

CVE-2022-31291 [HIGH] CWE-415 CVE-2022-31291: An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free v An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets.

CVE-2021-29507MEDIUMCVSS 6.5≥ 2.10.0, ≤ 2.18.62021-05-28

CVE-2021-29507 [MEDIUM] CWE-20 CVE-2021-29507: GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are using the configuration file could fail to generate their dlt logs in system. As of time of pub

CVE-2020-36244CRITICALCVSS 9.8fixed in 2.18.62021-02-10

CVE-2020-36244 [CRITICAL] CWE-787 CVE-2020-36244: The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow t The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary code on the DLT-Daemon (versions prior to 2.18.6).

CVE-2020-29394HIGHCVSS 7.8≤ 2.18.52020-11-30

CVE-2020-29394 [HIGH] CWE-787 CVE-2020-29394: A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GE A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows arbitrary code execution because fscanf is misused (no limit on the number of characters to be read in the format argument).