Threat Intelligence Database

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

COVESA Open1722 versions up to 0.9.2 contain a stack-based buffer overflow vulnerability in the avtp_to_can() function. This flaw allows unauthenticated remote attackers to send crafted UDP datagrams with more than 15 ACF-CAN messages, causing writes beyond the fixed 15-slot stack array. The vulnerability arises because the write index is incremented without proper bounds checking, and the listener accepts unauthenticated datagrams matching a hardcoded stream ID in plaintext. Exploitation could lead to arbitrary code execution or denial of service.