Headline
CVE-2022-25635: Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcast network packet length. An unauthenticated attacker in the adjacent network can exploit this vulnerability to disrupt service.
:::
- 首頁
- 資安服務
- 台灣漏洞揭露平台 (TVN)
- TVN (Taiwan Vulnerability Note) 漏洞公告
TVN ID
TVN-202205001
CVE ID
CVE-2022-25635
CVSS
6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
影響產品
Realtek Linux/Android Bluetooth Mesh SDK older than v4.17-4.17-20220127
問題描述
Realtek Linux/Android Bluetooth Mesh SDK未對廣播封包的長度驗證，導致Buffer Overflow漏洞。相鄰網路內的攻擊者不須權限，即可利用該漏洞中斷服務。
解決方法
Realtek Linux/Android Bluetooth Mesh SDK v4.18-4.18-20220218
漏洞通報者
Realtek
公開日期
2022-08-30