PT-2022-18407 · Git+2 · Zephyr

Henrik Brix Andersen · Published 2022-10-31 · Updated 2022-11-01 · CVE-2022-2741

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description A denial-of-service issue can be triggered by sending a specially crafted CAN frame on the same network as the vulnerable node. The frame must have a CAN ID that matches an installed filter in the node, which can be determined through CAN traffic analysis. Additionally, the frame must contain the opposite RTR bit compared to what the filter in the vulnerable node expects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-2741

GHSA-HX5V-J59Q-C3J8

Affected Products

Zephyr

References · 3

• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hx5v-j59q-c3j8 · Patch
• https://osv.dev/vulnerability/CVE-2022-2741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2741 · Security Note