CVE-2022-32293
ConnMan wispr_portal_web_result wp_object Double Free Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, leading to crashes or code execution.
En ConnMan versiones hasta 1.41, un ataque de tipo "man-in-the-middle" contra una consulta HTTP WISPR podría ser usado para desencadenar un uso de memoria previamente liberada en el manejo de WISPR, conllevando a bloqueos o ejecución de código
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ConnMan. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the wispr_portal_web_result method. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the ConnMan process.
This vulnerability was demonstrated on a Tesla Model 3 during Pwn2Own 2022 Vancouver competition.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-06-05 CVE Reserved
- 2022-08-03 CVE Published
- 2024-08-03 CVE Updated
- 2024-10-25 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=1200190 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://lore.kernel.org/connman/20220801080043.4861-1-wagi%40monom.org | 2023-12-21 | |
| https://lore.kernel.org/connman/20220801080043.4861-3-wagi%40monom.org | 2023-12-21 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202310-21 | 2023-12-21 | |
| https://www.debian.org/security/2022/dsa-5231 | 2023-12-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Intel Search vendor "Intel" | Connman Search vendor "Intel" for product "Connman" | <= 1.41 Search vendor "Intel" for product "Connman" and version " <= 1.41" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||