CyberRota Analysis
AI-GeneratedThe vulnerability affects COVESA Open1722 versions up to 0.9.2, where an integer truncation flaw in the CAN listener allows unauthenticated remote attackers to exploit the system. By sending a specially crafted UDP datagram, attackers can trigger a write loop that leaks approximately 18 KB of sensitive stack memory as CAN frames onto the bus. Organizations using this software should prioritize patching to mitigate the risk of data exposure and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.