CyberRota Analysis
AI-GeneratedAn unbounded memory allocation vulnerability exists in Sonic 3 A.I.R. that allows unauthenticated remote attackers to crash the server by sending a specially crafted UDP packet with a maximum uint32 value for the mUniquePacketID. This flaw can lead to significant service disruption as it exhausts host memory, triggering an uncaught exception that terminates the server process. Organizations using affected versions of Sonic 3 A.I.R. should prioritize patching this vulnerability to mitigate potential denial-of-service attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().