CVE-2020-29394

A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows arbitrary code execution because fscanf is misused (no limit on the number of characters to be read in the format argument).

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

1.94% chance of exploitation in the next 30 days, 79th percentile

Published

2020-11-30

Updated

2024-08-04

Proof-of-concept exploits (1)

• GENIVI/dlt-daemon/issues/274

References

• CVE Record
• NVD entry

Related

• CVE-2020-29392
• CVE-2020-29395
• CVE-2020-29390
• CVE-2020-29436
• CVE-2020-29384
• CVE-2020-29437