PT-2024-13255 · Unknown · Ailux Imx6 Bundle

Andrea Palanca · Published 2024-03-05 · Updated 2024-03-05 · CVE-2023-45591

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AiLux imx6 bundle versions prior to imx6 1.0.7-2

Description A heap-based buffer overflow vulnerability in the logger generic function of the Ax rtu binary allows a remote authenticated attacker to trigger a memory corruption. This may result in a Denial-of-Service (DoS) condition, possibly in the execution of arbitrary code with the same privileges of the process (root), or have other unspecified impacts on the device.

Recommendations For AiLux imx6 bundle versions prior to imx6 1.0.7-2, update to version imx6 1.0.7-2 or later to resolve the issue. As a temporary workaround, consider disabling the logger generic function in the Ax rtu binary until a patch is available. Restrict access to the Ax rtu binary to minimize the risk of exploitation.

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2023-45591

Affected Products

Ailux Imx6 Bundle

References · 6

• https://osv.dev/vulnerability/CVE-2023-45591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45591 · Security Note
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591 · Note
• https://twitter.com/CVEnew/status/1764978593254269300 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1765008898820284927 · Twitter Post
• https://t.me/cvenotify/73002 · Telegram Post