Threats Tagged 'cve-2025-67268'

A heap-based out-of-bounds write vulnerability exists in gpsd's NMEA2000 packet handling, allowing arbitrary code execution. gpsd is a daemon that provides access to GPS sensor data via TCP port 2947. This vulnerability affects Red Hat Enterprise Linux 10.0 Extended Update Support versions. Red Hat has issued a security advisory with updated packages to address this issue.

Red Hat has issued a security advisory for gpsd-minimal addressing two vulnerabilities: a denial of service caused by malformed NAVCOM packet parsing (CVE-2025-67269) and arbitrary code execution via a heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268). These issues affect gpsd, a daemon that provides GPS sensor data over TCP port 2947. The advisory covers Red Hat Enterprise Linux 9 and related variants. The update is rated as Important by Red Hat Product Security. A fix is available in updated gpsd-minimal packages for affected Red Hat Enterprise Linux 9 versions.

A heap-based out-of-bounds write vulnerability exists in gpsd prior to commit dc966aa in the handling of NMEA2000 PGN 129540 packets. The vulnerability arises because the satellite count provided by a user is not properly validated against the fixed size of the skyview array, allowing writes beyond its bounds. This can lead to memory corruption, denial of service, and potentially arbitrary code execution. Red Hat has issued a security update for gpsd in Red Hat Enterprise Linux 10.0 Extended Update Support to address this issue.

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.