Lucene search

GoogleOSV:CVE-2023-30463

HistoryApr 19, 2023 - 12:15 p.m.

CVE-2023-30463

2023-04-1912:15:08

Google

osv.dev

altran picotcp

memory corruption

denial of service

ethernet support

integer overflow

icmpv6

packet size

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

35.6%

JSON

Altran picoTCP through 1.7.0 allows memory corruption (and subsequent denial of service) because of an integer overflow in pico_ipv6_alloc when processing large ICMPv6 packets. This affects installations with Ethernet support in which a packet size greater than 65495 may occur.

References

georgyg.com/home/picotcp-denial-of-service-cve-2023-30463/

github.com/tass-belgium/picotcp/releases

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

35.6%

JSON

Related for OSV:CVE-2023-30463