github - ghsa-8hhg-rh8g-2x9h

GHSA-8HHG-RH8G-2X9H

Vulnerability from github – Published: 2022-02-15 00:02 – Updated: 2022-02-20 00:00

Details

The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-24705"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-120"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-14T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.",
  "id": "GHSA-8hhg-rh8g-2x9h",
  "modified": "2022-02-20T00:00:40Z",
  "published": "2022-02-15T00:02:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24705"
    },
    {
      "type": "WEB",
      "url": "https://github.com/accel-ppp/accel-ppp/pull/35"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2022-24705 (GCVE-0-2022-24705)

Vulnerability from cvelistv5 – Published: 2022-02-14 21:04 – Updated: 2024-09-16 18:39

Summary

Severity ?

No CVSS data available.

CWE

https://cwe.mitre.org/data/definitions/120.html

Assigner

GovTech CSG

References

URL

Tags

https://github.com/accel-ppp/accel-ppp/pull/35

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	https://accel-ppp.org/	accel-ppp	Affected: 1.12 , ≤ 1.12 (custom)

Credits

Chloe Ong from Government Technology Agency of Singapore Eugene Lim from Government Technology Agency of Singapore Kar Wei Loh from Government Technology Agency of Singapore

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:50.205Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/accel-ppp/accel-ppp/pull/35"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "accel-ppp",
          "vendor": "https://accel-ppp.org/",
          "versions": [
            {
              "lessThanOrEqual": "1.12",
              "status": "affected",
              "version": "1.12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Chloe Ong from Government Technology Agency of Singapore"
        },
        {
          "lang": "en",
          "value": "Eugene Lim from Government Technology Agency of Singapore"
        },
        {
          "lang": "en",
          "value": "Kar Wei Loh from Government Technology Agency of Singapore"
        }
      ],
      "datePublic": "2022-02-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "https://cwe.mitre.org/data/definitions/120.html",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-14T21:04:30",
        "orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
        "shortName": "GovTech CSG"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/accel-ppp/accel-ppp/pull/35"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve_disclosure@tech.gov.sg",
          "DATE_PUBLIC": "2022-02-10T07:32:00.000Z",
          "ID": "CVE-2022-24705",
          "STATE": "PUBLIC",
          "TITLE": "Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "accel-ppp",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "1.12",
                            "version_value": "1.12"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "https://accel-ppp.org/"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Chloe Ong from Government Technology Agency of Singapore"
          },
          {
            "lang": "eng",
            "value": "Eugene Lim from Government Technology Agency of Singapore"
          },
          {
            "lang": "eng",
            "value": "Kar Wei Loh from Government Technology Agency of Singapore"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "https://cwe.mitre.org/data/definitions/120.html"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/accel-ppp/accel-ppp/pull/35",
              "refsource": "MISC",
              "url": "https://github.com/accel-ppp/accel-ppp/pull/35"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
    "assignerShortName": "GovTech CSG",
    "cveId": "CVE-2022-24705",
    "datePublished": "2022-02-14T21:04:30.848419Z",
    "dateReserved": "2022-02-10T00:00:00",
    "dateUpdated": "2024-09-16T18:39:19.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-8HHG-RH8G-2X9H

CVE-2022-24705 (GCVE-0-2022-24705)

Tags

Sightings

Nomenclature