CVE-2026-73523— covesa Open1722 数字错误漏洞

COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

数值截断错误

covesa Open1722 数字错误漏洞

covesa Open1722是covesa组织的一款网络服务器设备。 covesa Open1722 0.9.2及之前版本存在数字错误漏洞，该漏洞源于acf-can-listener.c文件中的整数截断问题，num_can_msgs变量声明为uint8_t，将avtp_to_can()函数返回的-1错误值截断为255，导致写循环在15槽栈数组上迭代255次，可能允许未经身份验证的远程攻击者通过发送带有匹配AVTP流ID的拒绝UDP数据报，使CAN监听器将进程栈内存传输到CAN总线，泄露约18KB相邻栈内

N/A

N/A