CVE-2023-43628 - OpenCVE

An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. A specially crafted network packet can lead to memory corruption. An attacker can send a malicious packet to trigger this vulnerability.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Gpsd Project	Gpsd

Configuration 1 [-]

cpe:2.3:a:gpsd_project:gpsd:3.25.1:dev:*:*:*:*:*:*

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1860	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: talos

Published: 2023-12-05T11:35:01.035Z

Updated: 2023-12-06T18:39:43.190Z

Reserved: 2023-11-15T15:08:16.534Z

Link: CVE-2023-43628

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-12-05T12:15:43.000

Modified: 2023-12-11T15:24:22.683

Link: CVE-2023-43628

JSON object: View

Redhat Information

No data.

CWE

CWE-191

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gpsd_project:gpsd:3.25.1:dev:*:*:*:*:*:*", "matchCriteriaId": "63B52FC8-5957-4408-9E20-B90EE1ADF678", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. A specially crafted network packet can lead to memory corruption. An attacker can send a malicious packet to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de enteros en la funcionalidad NTRIP Stream Parsing de GPSd 3.25.1~dev. Un paquete de red especialmente manipulado puede provocar da\u00f1os en la memoria. Un atacante puede enviar un paquete malicioso para desencadenar esta vulnerabilidad."}], "id": "CVE-2023-43628", "lastModified": "2023-12-11T15:24:22.683", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "talos-cna@cisco.com", "type": "Secondary"}]}, "published": "2023-12-05T12:15:43.000", "references": [{"source": "talos-cna@cisco.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1860"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-191"}], "source": "talos-cna@cisco.com", "type": "Secondary"}]}