PT-2022-6503 · Wind River · Vxworks

Published 2022-11-25 · Updated 2023-03-14 · CVE-2022-38767

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Wind River VxWorks versions 6.9 through 7

Description The issue allows a specifically crafted packet sent by a Radius server to cause Denial of Service during the IP Radius access procedure. This is related to the execution of a loop with an unavailable exit condition. Exploitation of the issue may allow a remote attacker to cause a Denial of Service by sending a specially crafted packet.

Recommendations For Wind River VxWorks versions 6.9 through 7, consider disabling the IP Radius access procedure until a patch is available to prevent Denial of Service attacks. Restrict access to the Radius server to minimize the risk of exploitation. Avoid using the Radius protocol in the affected IP Radius access procedure until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2023-01788

CVE-2022-38767

Affected Products

Vxworks

References · 11

• https://bdu.fstec.ru/vul/2023-01788 · Security Note
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2022-38767 · Vendor Advisory
• https://windriver.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38767 · Security Note
• https://t.me/cibsecurity/53497 · Telegram Post
• https://t.me/cvenotify/38461 · Telegram Post
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2022-38767 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-726834.pdf · Note
• https://t.me/cvenotify/38471 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-726834.html · Note