PT-2022-24862 · Unknown · Loramac-Node

Mluis1 · Published 2022-10-06 · Updated 2023-06-27 · CVE-2022-39274

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LoRaMac-node versions prior to 4.7.0

Description The issue is caused by improper size validation of incoming radio frames, which can lead to a buffer overflow. Specifically, the function ProcessRadioRxDone expects incoming radio frames to have at least a payload of one byte or more. An empty payload can result in a 1-byte out-of-bounds read of user-controlled content. An attacker can craft a FRAME TYPE PROPRIETARY frame with size -1, leading to a 65280-byte out-of-bounds memcopy with partially controlled attacker data. This can cause a Denial of Service (DoS) or potentially allow the attacker to gain control over the execution.

Recommendations For versions prior to 4.7.0, upgrade to version 4.7.0 or later by updating the package or manually applying the patch commit e851b079.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-193

CWE-120

Related Identifiers

CVE-2022-39274

GHSA-7VV8-73PC-63C2

Affected Products

Loramac-Node

References · 6

• 🔥 https://github.com/Lora-net/LoRaMac-node/security/advisories/GHSA-7vv8-73pc-63c2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39274.json · Exploit
• https://github.com/Lora-net/LoRaMac-node/commit/e851b079c82ba1bcf3f4d291ab69a571b0bf458a · Patch
• https://osv.dev/vulnerability/CVE-2022-39274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39274 · Security Note
• https://github.com/Lora-net/LoRaMac-node/releases/tag/v4.7.0 · Note