PT-2021-4110 · Genivia+1 · Genivi Diagnostic Log/Trace+1

Thanhbnq · Published 2021-03-30 · Updated 2022-08-02 · CVE-2021-29507

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GENIVI Diagnostic Log and Trace (DLT) versions 2.10.0 through 2.18.6

Description The issue is related to the incorrect handling of special characters in configuration files, which can cause a vulnerable component to crash. This can lead to applications using the configuration file failing to generate their logs. The problem can be exploited by a remote attacker to cause a denial of service. As of the time of publication, no patch exists for this issue.

Recommendations For GENIVI DLT versions 2.10.0 through 2.18.6, as a temporary workaround, one may manually check the integrity of the information in the configuration file to prevent the crash of the vulnerable component. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-04698

CVE-2021-29507

GHSA-7CQP-2HQJ-MH3F

Affected Products

Debian

Genivi Diagnostic Log/Trace

References · 10

• https://cve.org/CVERecord?id=CVE-2021-29507 · Security Note
• https://bdu.fstec.ru/vul/2021-04698 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29507 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29507 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29507 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29507 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-29507 · Vendor Advisory
• https://github.com/GENIVI/dlt-daemon/security/advisories/GHSA-7cqp-2hqj-mh3f · Note
• https://github.com/GENIVI/dlt-daemon/commit/f5344f8cf036e6dcb899522e8e679639dd23e1a4 · Note