Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:44345
HistoryNov 22, 2023 - 5:56 a.m.

Stack-based Buffer Overflow

2023-11-2205:56:35
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
libzephyr.so
buffer overflow
le_ecred_reconf_req
dos

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

42.2%

libzephyr.so is vulnerable to Stack-based Buffer Overflow. The vulnerability is due to the le_ecred_reconf_req function insubsys/bluetooth/host/l2cap.c because the chan_count variable value becomes greater than maximum value allowed in L2CAP_ECRED_CHAN_MAX_PER_REQ. This leads to buffer overflow resulting in Denial Of Service (DOS).

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

42.2%

Related for VERACODE:44345