Login Request a demo
Medium severity · published May 28, 2021
CVE-2021-29507
GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are using the configuration file could fail to generate their dlt logs in system. As of time of publication, no patch exists. As a workaround, one may check the integrity of information in configuration file manually.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Diagnostic Log And Trace · Genivi
2.10.0 through 2.18.6 · source: NVD
Affected product
DL
Diagnostic Log And Trace
Genivi
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29507
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29507
Third Party Advisory
https://github.com/GENIVI/dlt-daemon/security/advisories/GHSA-7cqp-2hqj-mh3f
More from Diagnostic Log And Trace
9.8
CVE-2020-36244
The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary code on the…
7.8
CVE-2020-29394
A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows arbitrary code execution because fscanf…
7.5
CVE-2022-31291
An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets
5.5
CVE-2022-39836
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8
5.5
CVE-2022-39837
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8