Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to an attacker-declared message size before validating that the declared bytes have actually been received, allowing a remote, unauthenticated peer to exhaust host memory and deny service.
VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling
About this summary. This is a short excerpt from the description that CERT/CC published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://kb.cert.org/vuls/id/128947
Source attribution: headline and facts are from CERT/CC (kb.cert.org). Summary method: excerpt of the source description. See our source attribution policy.