Vulnerability-Lookup

CNVD-2019-46624

Vulnerability from cnvd - Published: 2019-12-24

Title

Huawei Atlas 300和Atlas 500缓冲区溢出漏洞

Description

Huawei Atlas 300和Atlas 500都是中国华为（Huawei）公司的产品。Atlas 300是一款AI（人工智能）加速卡。该产品适用于人工智能训练和推理场景。 Huawei Atlas 300 1.0.0版本和Huawei Atlas 500 1.0.0版本中存在缓冲区溢出漏洞，本地攻击者可通过将构造的参数发送到进程利用该漏洞导致拒绝服务。

Severity

低

Patch Name

Huawei Atlas 300和Atlas 500缓冲区溢出漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20191127-01-atlas-cn

Reference

https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20191127-01-atlas-cn

Impacted products

Name
['Huawei Atlas 300 1.0.0', 'Huawei Atlas 500 1.0.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-5247",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5247"
    }
  },
  "description": "Huawei Atlas 300\u548cAtlas 500\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Atlas 300\u662f\u4e00\u6b3eAI\uff08\u4eba\u5de5\u667a\u80fd\uff09\u52a0\u901f\u5361\u3002\u8be5\u4ea7\u54c1\u9002\u7528\u4e8e\u4eba\u5de5\u667a\u80fd\u8bad\u7ec3\u548c\u63a8\u7406\u573a\u666f\u3002\n\nHuawei Atlas 300 1.0.0\u7248\u672c\u548cHuawei Atlas 500 1.0.0\u7248\u672c\u4e2d\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u672c\u5730\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5c06\u6784\u9020\u7684\u53c2\u6570\u53d1\u9001\u5230\u8fdb\u7a0b\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20191127-01-atlas-cn",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-46624",
  "openTime": "2019-12-24",
  "patchDescription": "Huawei Atlas 300\u548cAtlas 500\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Atlas 300\u662f\u4e00\u6b3eAI\uff08\u4eba\u5de5\u667a\u80fd\uff09\u52a0\u901f\u5361\u3002\u8be5\u4ea7\u54c1\u9002\u7528\u4e8e\u4eba\u5de5\u667a\u80fd\u8bad\u7ec3\u548c\u63a8\u7406\u573a\u666f\u3002\r\n\r\nHuawei Atlas 300 1.0.0\u7248\u672c\u548cHuawei Atlas 500 1.0.0\u7248\u672c\u4e2d\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u672c\u5730\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5c06\u6784\u9020\u7684\u53c2\u6570\u53d1\u9001\u5230\u8fdb\u7a0b\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei Atlas 300\u548cAtlas 500\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei Atlas 300 1.0.0",
      "Huawei Atlas 500 1.0.0"
    ]
  },
  "referenceLink": "https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20191127-01-atlas-cn",
  "serverity": "\u4f4e",
  "submitTime": "2019-11-27",
  "title": "Huawei Atlas 300\u548cAtlas 500\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2019-5247 (GCVE-0-2019-5247)

Vulnerability from cvelistv5 – Published: 2019-11-29 20:05 – Updated: 2024-08-04 19:47

Summary

Huawei Atlas 300, Atlas 500 have a buffer overflow vulnerability. A local, authenticated attacker may craft specific parameter and send to the process to exploit this vulnerability. Successfully exploit may cause service crash.

Severity

No CVSS data available.

CWE

Buffer Overflow

Assigner

huawei

References

1 reference

URL	Tags
https://www.huawei.com/en/psirt/security-advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	Atlas 300, Atlas 500	Affected: 1.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:47:56.789Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-atlas-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Atlas 300, Atlas 500",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Huawei Atlas 300, Atlas 500 have a buffer overflow vulnerability. A local, authenticated attacker may craft specific parameter and send to the process to exploit this vulnerability. Successfully exploit may cause service crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Buffer Overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-29T20:05:45.000Z",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-atlas-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2019-5247",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Atlas 300, Atlas 500",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Huawei Atlas 300, Atlas 500 have a buffer overflow vulnerability. A local, authenticated attacker may craft specific parameter and send to the process to exploit this vulnerability. Successfully exploit may cause service crash."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-atlas-en",
              "refsource": "CONFIRM",
              "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-atlas-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2019-5247",
    "datePublished": "2019-11-29T20:05:45.000Z",
    "dateReserved": "2019-01-04T00:00:00.000Z",
    "dateUpdated": "2024-08-04T19:47:56.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-46624

CVE-2019-5247 (GCVE-0-2019-5247)

Tags

Sightings

Nomenclature