CVE-2022-3409

A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/openbmc/bmcweb	Product Third Party Advisory
https://github.com/openbmc/bmcweb	Product Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openbmc-project:openbmc:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:19

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 8.2
References	~~() https://github.com/openbmc/bmcweb - Product, Third Party Advisory~~	() https://github.com/openbmc/bmcweb - Product, Third Party Advisory

Information

Published : 2022-10-27 13:15

Updated : 2024-11-21 07:19

NVD link : CVE-2022-3409

Mitre link : CVE-2022-3409

CVE.ORG link : CVE-2022-3409

JSON object : View

Products Affected

openbmc-project

openbmc

CWE

CWE-121

Stack-based Buffer Overflow

CWE-229

Improper Handling of Values

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-3409", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "openbmc-security@lists.ozlabs.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-10-27T13:15:11.047", "references": [{"url": "https://github.com/openbmc/bmcweb", "tags": ["Product", "Third Party Advisory"], "source": "openbmc-security@lists.ozlabs.org"}, {"url": "https://github.com/openbmc/bmcweb", "tags": ["Product", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "openbmc-security@lists.ozlabs.org", "description": [{"lang": "en", "value": "CWE-121"}, {"lang": "en", "value": "CWE-229"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS."}, {"lang": "es", "value": "Una vulnerabilidad en bmcweb del OpenBMC Project permite al usuario provocar una denegaci\u00f3n de servicio. Esta vulnerabilidad se identific\u00f3 durante la mitigaci\u00f3n de CVE-2022-2809. Al difuminar el c\u00f3digo multipart_parser usando AFL++ con el sanitizador de direcciones habilitado para encontrar las corrupciones de memoria m\u00e1s peque\u00f1as posibles. Detect\u00f3 un problema en c\u00f3mo multipart_parser maneja los encabezados http no cerrados. Si se pasa un encabezado http lo suficientemente largo en formato de varias partes sin dos puntos, se sobrescribe un byte en la memoria. Se puede realizar varias veces en un bucle para provocar DoS."}], "lastModified": "2024-11-21T07:19:27.627", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openbmc-project:openbmc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A97D389D-CCB5-42DF-BB5F-BD62F4DF4A11", "versionEndIncluding": "2.13.0", "versionStartIncluding": "2.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "openbmc-security@lists.ozlabs.org"}