PT-2022-25319 · Samsung · Tizenrt

Uvscan · Published 2022-09-08 · Updated 2022-09-13 · CVE-2022-40280

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Samsung TizenRT versions through 3.0 GBM and 3.1 PRE

Description An issue was discovered in the createDB function within the provisioningdatabasemanager.c file, located in the security/provisioning/src directory. This issue is caused by a missing sqlite3 close call after sqlite3 open v2, resulting in a denial of service.

Recommendations For Samsung TizenRT versions through 3.0 GBM and 3.1 PRE, consider applying a patch that includes the necessary sqlite3 close call after sqlite3 open v2 in the createDB function to prevent a denial of service.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2022-40280

Affected Products

Tizenrt

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-40280 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40280 · Vendor Advisory
• https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L100 · Note
• https://github.com/Samsung/TizenRT/issues/5627 · Note
• https://t.me/cvenotify/35916 · Telegram Post
• https://t.me/cvenotify/35912 · Telegram Post
• https://sqlite.org/c3ref/open.html · Note