CVE-2022-2809
Unauthenticated out of bounds heap write in bmcweb
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
Una vulnerabilidad en bmcweb del OpenBMC Project permite al usuario provocar una denegación de servicio. Al difuminar el código multipart_parser usando AFL++ con el sanitizador de direcciones habilitado para encontrar las corrupciones de memoria más pequeñas posibles. Se detectó un problema en cómo multipart_parser maneja los encabezados http no cerrados. Si se pasa un encabezado http lo suficientemente largo en formato de varias partes sin dos puntos, se sobrescribe un byte en la memoria. Se puede realizar varias veces en un bucle para provocar DoS.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-08-13 CVE Reserved
- 2022-10-27 CVE Published
- 2024-04-29 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-229: Improper Handling of Values
- CWE-787: Out-of-bounds Write
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Openbmc-project Search vendor "Openbmc-project" | Openbmc Search vendor "Openbmc-project" for product "Openbmc" | >= 2.10.0 <= 2.13.0 Search vendor "Openbmc-project" for product "Openbmc" and version " >= 2.10.0 <= 2.13.0" | - |
Affected
|