CVE-2024-3979 (GCVE-0-2024-3979)
Vulnerability from cvelistv5 – Published: 2024-04-19 18:00 – Updated: 2024-08-01 20:26
VLAI?
Title
COVESA vsomeip race condition
Summary
A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261596.
Severity ?
4.4 (Medium)
4.4 (Medium)
CWE
- CWE-362 - Race Condition
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
Credits
xuguosheng (VulDB User)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:covesa:vsomeip:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vsomeip",
"vendor": "covesa",
"versions": [
{
"lessThan": "3.4.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3979",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-22T23:59:52.816044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T19:45:48.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:26:57.251Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-261596 | COVESA vsomeip race condition",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://vuldb.com/?id.261596"
},
{
"name": "VDB-261596 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.261596"
},
{
"name": "Submit #312410 | Bayerische Motoren Werke Aktiengesellschaft vsomeip 3.4.10 Concurrency Bug",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.312410"
},
{
"tags": [
"issue-tracking",
"x_transferred"
],
"url": "https://github.com/COVESA/vsomeip/issues/663"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/COVESA/vsomeip/files/14904610/details.zip"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "vsomeip",
"vendor": "COVESA",
"versions": [
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.4.1"
},
{
"status": "affected",
"version": "3.4.2"
},
{
"status": "affected",
"version": "3.4.3"
},
{
"status": "affected",
"version": "3.4.4"
},
{
"status": "affected",
"version": "3.4.5"
},
{
"status": "affected",
"version": "3.4.6"
},
{
"status": "affected",
"version": "3.4.7"
},
{
"status": "affected",
"version": "3.4.8"
},
{
"status": "affected",
"version": "3.4.9"
},
{
"status": "affected",
"version": "3.4.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xuguosheng (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261596."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in COVESA vsomeip bis 3.4.10 entdeckt. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion. Mittels dem Manipulieren mit unbekannten Daten kann eine race condition-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.2,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-19T18:00:08.395Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-261596 | COVESA vsomeip race condition",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.261596"
},
{
"name": "VDB-261596 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.261596"
},
{
"name": "Submit #312410 | Bayerische Motoren Werke Aktiengesellschaft vsomeip 3.4.10 Concurrency Bug",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.312410"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/COVESA/vsomeip/issues/663"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/COVESA/vsomeip/files/14904610/details.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-04-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-04-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-19T15:00:52.000Z",
"value": "VulDB entry last update"
}
],
"title": "COVESA vsomeip race condition"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-3979",
"datePublished": "2024-04-19T18:00:08.395Z",
"dateReserved": "2024-04-19T12:42:20.228Z",
"dateUpdated": "2024-08-01T20:26:57.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261596.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad fue encontrada en COVESA vsomeip hasta 3.4.10 y clasificada como problem\\u00e1tica. Una funci\\u00f3n desconocida es afectada por este problema. La manipulaci\\u00f3n conduce a la condici\\u00f3n de ejecuci\\u00f3n. Un ataque debe abordarse localmente. El exploit ha sido divulgado al p\\u00fablico y puede utilizarse. El identificador de esta vulnerabilidad es VDB-261596.\"}]",
"id": "CVE-2024-3979",
"lastModified": "2024-11-21T09:30:49.047",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"cna@vuldb.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\", \"baseScore\": 4.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 2.5}], \"cvssMetricV2\": [{\"source\": \"cna@vuldb.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:S/C:N/I:P/A:P\", \"baseScore\": 3.2, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.1, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2024-04-19T18:15:08.993",
"references": "[{\"url\": \"https://github.com/COVESA/vsomeip/files/14904610/details.zip\", \"source\": \"cna@vuldb.com\"}, {\"url\": \"https://github.com/COVESA/vsomeip/issues/663\", \"source\": \"cna@vuldb.com\"}, {\"url\": \"https://vuldb.com/?ctiid.261596\", \"source\": \"cna@vuldb.com\"}, {\"url\": \"https://vuldb.com/?id.261596\", \"source\": \"cna@vuldb.com\"}, {\"url\": \"https://vuldb.com/?submit.312410\", \"source\": \"cna@vuldb.com\"}, {\"url\": \"https://github.com/COVESA/vsomeip/files/14904610/details.zip\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/COVESA/vsomeip/issues/663\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://vuldb.com/?ctiid.261596\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://vuldb.com/?id.261596\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://vuldb.com/?submit.312410\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cna@vuldb.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"cna@vuldb.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-3979\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2024-04-19T18:15:08.993\",\"lastModified\":\"2024-11-21T09:30:49.047\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261596.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad fue encontrada en COVESA vsomeip hasta 3.4.10 y clasificada como problem\u00e1tica. Una funci\u00f3n desconocida es afectada por este problema. La manipulaci\u00f3n conduce a la condici\u00f3n de ejecuci\u00f3n. Un ataque debe abordarse localmente. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. El identificador de esta vulnerabilidad es VDB-261596.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":2.5}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:S/C:N/I:P/A:P\",\"baseScore\":3.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.1,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"references\":[{\"url\":\"https://github.com/COVESA/vsomeip/files/14904610/details.zip\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/COVESA/vsomeip/issues/663\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/?ctiid.261596\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/?id.261596\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/?submit.312410\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/COVESA/vsomeip/files/14904610/details.zip\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/COVESA/vsomeip/issues/663\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://vuldb.com/?ctiid.261596\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://vuldb.com/?id.261596\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://vuldb.com/?submit.312410\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://vuldb.com/?id.261596\", \"name\": \"VDB-261596 | COVESA vsomeip race condition\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}, {\"url\": \"https://vuldb.com/?ctiid.261596\", \"name\": \"VDB-261596 | CTI Indicators (IOB, IOC)\", \"tags\": [\"signature\", \"permissions-required\", \"x_transferred\"]}, {\"url\": \"https://vuldb.com/?submit.312410\", \"name\": \"Submit #312410 | Bayerische Motoren Werke Aktiengesellschaft vsomeip 3.4.10 Concurrency Bug\", \"tags\": [\"third-party-advisory\", \"x_transferred\"]}, {\"url\": \"https://github.com/COVESA/vsomeip/issues/663\", \"tags\": [\"issue-tracking\", \"x_transferred\"]}, {\"url\": \"https://github.com/COVESA/vsomeip/files/14904610/details.zip\", \"tags\": [\"exploit\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T20:26:57.251Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-3979\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-22T23:59:52.816044Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:covesa:vsomeip:*:*:*:*:*:*:*:*\"], \"vendor\": \"covesa\", \"product\": \"vsomeip\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.4.10\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-04-23T00:01:52.149Z\"}}], \"cna\": {\"title\": \"COVESA vsomeip race condition\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"xuguosheng (VulDB User)\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 4.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 4.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 3.2, \"vectorString\": \"AV:L/AC:L/Au:S/C:N/I:P/A:P\"}}], \"affected\": [{\"vendor\": \"COVESA\", \"product\": \"vsomeip\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.4.0\"}, {\"status\": \"affected\", \"version\": \"3.4.1\"}, {\"status\": \"affected\", \"version\": \"3.4.2\"}, {\"status\": \"affected\", \"version\": \"3.4.3\"}, {\"status\": \"affected\", \"version\": \"3.4.4\"}, {\"status\": \"affected\", \"version\": \"3.4.5\"}, {\"status\": \"affected\", \"version\": \"3.4.6\"}, {\"status\": \"affected\", \"version\": \"3.4.7\"}, {\"status\": \"affected\", \"version\": \"3.4.8\"}, {\"status\": \"affected\", \"version\": \"3.4.9\"}, {\"status\": \"affected\", \"version\": \"3.4.10\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-04-19T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2024-04-19T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2024-04-19T15:00:52.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/?id.261596\", \"name\": \"VDB-261596 | COVESA vsomeip race condition\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"https://vuldb.com/?ctiid.261596\", \"name\": \"VDB-261596 | CTI Indicators (IOB, IOC)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/?submit.312410\", \"name\": \"Submit #312410 | Bayerische Motoren Werke Aktiengesellschaft vsomeip 3.4.10 Concurrency Bug\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/COVESA/vsomeip/issues/663\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/COVESA/vsomeip/files/14904610/details.zip\", \"tags\": [\"exploit\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261596.\"}, {\"lang\": \"de\", \"value\": \"Eine problematische Schwachstelle wurde in COVESA vsomeip bis 3.4.10 entdeckt. Es geht hierbei um eine nicht n\\u00e4her spezifizierte Funktion. Mittels dem Manipulieren mit unbekannten Daten kann eine race condition-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur \\u00f6ffentlichen Verf\\u00fcgung.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Race Condition\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2024-04-19T18:00:08.395Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-3979\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T20:26:57.251Z\", \"dateReserved\": \"2024-04-19T12:42:20.228Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2024-04-19T18:00:08.395Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…