CVE-2017-17066 Information disclosure in n/a
Remote attackers can read sensitive router memory via crafted Garlic DeliveryTypeTunnel packets in i2pd and kovri implementations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-17066?
CVE-2017-17066 is a high-severity vulnerability in n/a, published on 5 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The (1) i2pd before 2.17 and (2) kovri pre-alpha implementations of the I2P routing protocol do not properly handle Garlic DeliveryTypeTunnel packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading sensitive router memory, aka the GarlicRust bug.
Weakness: CWE-125
Which versions are affected by CVE-2017-17066?
It affects 2 products.
Products include Getkovri Kovri, I2pd I2pd.
How do I fix CVE-2017-17066?
No fix has been published for CVE-2017-17066 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-17066 being exploited?
There is no known exploitation of CVE-2017-17066 in the wild and no public exploit code.
Sources
Also known as GHSA-rmv7-m6j3-p2f9.