CVE-2022-24704 (GCVE-0-2022-24704)

Vulnerability from cvelistv5 – Published: 2022-02-14 21:04 – Updated: 2024-09-16 19:00
VLAI?
Summary
The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer &attr->val.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered.
Severity ?
No CVSS data available.
CWE
  • https://cwe.mitre.org/data/definitions/120.html
Assigner
References
Impacted products
Vendor Product Version
https://accel-ppp.org/ Accel-PPP Affected: 1.12 , ≤ 1.12 (custom)
Create a notification for this product.
Credits
Chloe Ong from Government Technology Agency of Singapore Eugene Lim from Government Technology Agency of Singapore Kar Wei Loh from Government Technology Agency of Singapore
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:50.190Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/accel-ppp/accel-ppp/pull/35"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Accel-PPP",
          "vendor": "https://accel-ppp.org/",
          "versions": [
            {
              "lessThanOrEqual": "1.12",
              "status": "affected",
              "version": "1.12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Chloe Ong from Government Technology Agency of Singapore"
        },
        {
          "lang": "en",
          "value": "Eugene Lim from Government Technology Agency of Singapore"
        },
        {
          "lang": "en",
          "value": "Kar Wei Loh from Government Technology Agency of Singapore"
        }
      ],
      "datePublic": "2022-02-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer \u0026attr-\u003eval.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "https://cwe.mitre.org/data/definitions/120.html",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-14T21:04:29",
        "orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
        "shortName": "GovTech CSG"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/accel-ppp/accel-ppp/pull/35"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve_disclosure@tech.gov.sg",
          "DATE_PUBLIC": "2022-02-10T07:47:00.000Z",
          "ID": "CVE-2022-24704",
          "STATE": "PUBLIC",
          "TITLE": "Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Accel-PPP",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "1.12",
                            "version_value": "1.12"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "https://accel-ppp.org/"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Chloe Ong from Government Technology Agency of Singapore"
          },
          {
            "lang": "eng",
            "value": "Eugene Lim from Government Technology Agency of Singapore"
          },
          {
            "lang": "eng",
            "value": "Kar Wei Loh from Government Technology Agency of Singapore"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer \u0026attr-\u003eval.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "https://cwe.mitre.org/data/definitions/120.html"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/accel-ppp/accel-ppp/pull/35",
              "refsource": "MISC",
              "url": "https://github.com/accel-ppp/accel-ppp/pull/35"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
    "assignerShortName": "GovTech CSG",
    "cveId": "CVE-2022-24704",
    "datePublished": "2022-02-14T21:04:29.942661Z",
    "dateReserved": "2022-02-10T00:00:00",
    "dateUpdated": "2024-09-16T19:00:04.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:accel-ppp:accel-ppp:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.12.0\", \"matchCriteriaId\": \"CB0C5840-2CCB-4241-8AD3-F3A591D314AA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer \u0026attr-\u003eval.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered.\"}, {\"lang\": \"es\", \"value\": \"La funci\\u00f3n rad_packet_recv en el archivo opt/src/accel-pppd/radius/packet.c sufre una vulnerabilidad de desbordamiento de b\\u00fafer, por la que la entrada del usuario len es copiada en un b\\u00fafer fijo \u0026amp;attr-\u0026gt;val.integer sin ninguna comprobaci\\u00f3n de l\\u00edmites. Si el cliente es conectado al servidor y env\\u00eda un paquete radius de gran tama\\u00f1o, ser\\u00e1 desencadenada una vulnerabilidad de desbordamiento del b\\u00fafer\"}]",
      "id": "CVE-2022-24704",
      "lastModified": "2024-11-21T06:50:54.790",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2022-02-14T22:15:08.230",
      "references": "[{\"url\": \"https://github.com/accel-ppp/accel-ppp/pull/35\", \"source\": \"cve_disclosure@tech.gov.sg\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/accel-ppp/accel-ppp/pull/35\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve_disclosure@tech.gov.sg",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-120\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-24704\",\"sourceIdentifier\":\"cve_disclosure@tech.gov.sg\",\"published\":\"2022-02-14T22:15:08.230\",\"lastModified\":\"2024-11-21T06:50:54.790\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer \u0026attr-\u003eval.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered.\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n rad_packet_recv en el archivo opt/src/accel-pppd/radius/packet.c sufre una vulnerabilidad de desbordamiento de b\u00fafer, por la que la entrada del usuario len es copiada en un b\u00fafer fijo \u0026amp;attr-\u0026gt;val.integer sin ninguna comprobaci\u00f3n de l\u00edmites. Si el cliente es conectado al servidor y env\u00eda un paquete radius de gran tama\u00f1o, ser\u00e1 desencadenada una vulnerabilidad de desbordamiento del b\u00fafer\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:accel-ppp:accel-ppp:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0\",\"matchCriteriaId\":\"CB0C5840-2CCB-4241-8AD3-F3A591D314AA\"}]}]}],\"references\":[{\"url\":\"https://github.com/accel-ppp/accel-ppp/pull/35\",\"source\":\"cve_disclosure@tech.gov.sg\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/accel-ppp/accel-ppp/pull/35\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.