CVE-2023-28488 - client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process

Back Back to CVE browser

MEDIUM

client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process

Published Apr 12, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.96%

Description

client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-32158
Advisory
https://github.com/moehw/poc_exploits/tree/master/CVE-2023-28488
ExploitPatchThird Party Advisory
https://kernel.googlesource.com/pub/scm/network/connman/connman/+/99e2c16ea1cced34a5dc450d76287a1c3e762138
Patch
https://lists.debian.org/debian-lts-announce/2023/04/msg00024.html
mailing-list
https://www.debian.org/security/2023/dsa-5416
vendor-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-32158		Advisory
https://github.com/moehw/poc_exploits/tree/master/CVE-2023-28488		ExploitPatchThird Party Advisory
https://kernel.googlesource.com/pub/scm/network/connman/connman/+/99e2c16ea1cced34a5dc450d76287a1c3e762138		Patch
https://lists.debian.org/debian-lts-announce/2023/04/msg00024.html		mailing-list
https://www.debian.org/security/2023/dsa-5416		vendor-advisory