PT-2021-11978 · Genivia · Genivi Diagnostic Log/Trace

Published 2021-02-10 · Updated 2023-02-03 · CVE-2020-36244

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GENIVI Diagnostic Log and Trace (DLT) versions prior to 2.18.6

Description: The daemon in GENIVI Diagnostic Log and Trace (DLT) is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary code on the DLT-Daemon. The issue is specifically related to the dlt buffer write block function in shared/dlt common.c.

Recommendations: For versions prior to 2.18.6, update to version 2.18.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the DLT-Daemon to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-36244

DLA-3231-1

Affected Products

Genivi Diagnostic Log/Trace

References · 15

• https://github.com/GENIVI/dlt-daemon/compare/v2.18.5...v2.18.6 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36244 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36244 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36244 · Security Note
• https://osv.dev/vulnerability/DLA-3231-1 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00016.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-36244 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36244 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36244 · Security Note
• https://github.com/GENIVI/dlt-daemon/issues/265 · Note
• https://github.com/GENIVI/dlt-daemon/pull/269 · Note
• https://github.com/GENIVI/dlt-daemon/commit/af734fe097ed379b0aa5fcf551886b1ce5098052 · Note
• https://t.me/cvenotify/9709 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-147-01 · Note