Description
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
driftregion iso14229
Default version status: unaffected
0 to < 0.10.1affected
pkg:github/driftregion/iso14229References
- https://github.com/driftregion/iso14229/security/advisories/GHSA-5hgv-5fqg-8vcr ↗
- https://github.com/driftregion/iso14229/security/advisories/GHSA-ph4f-7v39-8hgm ↗
- https://github.com/driftregion/iso14229/commit/2e36afcd7f0cd02b0c70446c1a265a7b1999d478 ↗
- https://github.com/driftregion/iso14229/blob/0.10.0/src/server.c#L1151-L1161 ↗
- https://github.com/driftregion/iso14229/releases/tag/0.10.1%2B9e7c47e8 ↗
- https://github.com/driftregion/iso14229 ↗
- https://www.vulncheck.com/advisories/iso14229-before-0.10.1-out-of-bounds-read-via-handle-0x38-requestfiletransfer ↗