Linux stim2wunda Driver Out-of-Bounds Read Vulnerability (CVE-2018-10001)

Vulnerability Summary: Out-of-bounds read from received frame-length underflow in the Stim2WUNDA IEEE 802.15.4 driver Vulnerability Overview The Stim2WUNDA IEEE 802.15.4 driver contains an underflow issue when processing the length of received frames, leading to an out-of-bounds read. This vulnerability allows an attacker to trigger a kernel panic or potential information disclosure by crafting malicious packets. CVE ID: CVE-2018-10001 CVSS Score: 4.2 (Medium) Affected Component: driver module (Linux kernel) Trigger Condition: Reception of a specifically crafted 802.15.4 frame where the length field is negative or extremely small, causing the calculated buffer index to go out of bounds. Scope of Impact Affected Versions: The driver module in the Linux kernel with enabled. Specific versions are not explicitly listed, but based on context, they are inferred to be older versions (e.g., the 4.x series). Affected Systems: Devices using the Stim2WUNDA driver, particularly systems running the Linux kernel with this driver enabled. Remediation Fixed Version: This vulnerability has been fixed in subsequent kernel versions. Fix Method: Modify the driver code to add boundary checks before parsing the frame length, preventing out-of-bounds access caused by negative or anomalous values. Patch Link: Fix patches can be obtained from the official kernel repository or distribution updates. POC Code / Exploit Code The page does not provide complete POC code or exploit code; it only describes the vulnerability trigger conditions and partial debugging information. The following is key debugging information extracted from the page: Additional Information Report Date: October 16, 2018 Reporter: Anonymous Related Resources: For more information, refer to official kernel announcements or security advisories.

Goal Reached Thanks to every supporter — we hit 100%!

Linux stim2wunda Driver Out-of-Bounds Read Vulnerability (CVE-2018-10001)

More from this source