Headline
CVE-2022-26529: Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow-3
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for segmented packets’ link parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.
:::
- 首頁
- 資安服務
- 台灣漏洞揭露平台 (TVN)
- TVN (Taiwan Vulnerability Note) 漏洞公告
TVN ID
TVN-202205004
CVE ID
CVE-2022-26529
CVSS
6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
影響產品
Realtek Linux/Android Bluetooth Mesh SDK older than v4.17-4.17-20220127
問題描述
Realtek Linux/Android Bluetooth Mesh SDK未對segmented packets之鏈結參數進行檢查，導致預期外的封包寫入記憶體，而溢出預先配置的buffer長度，造成Buffer Overflow漏洞。相鄰網路內的攻擊者不須權限，即可利用該漏洞中斷服務。
解決方法
Realtek Linux/Android Bluetooth Mesh SDK v4.18-4.18-20220218
漏洞通報者
Realtek
公開日期
2022-08-30