CVE-2022-31364 Memory corruption in n/a
Remote attackers can execute arbitrary code via a buffer overflow in the Cypress Bluetooth Mesh SDK triggered by inconsistent segmented packets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31364?
CVE-2022-31364 is a high-severity memory corruption vulnerability in n/a, published on 1 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is lower_transport_layer_on_seg. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered by sending a series of segmented packets with inconsistent SegN.
Weakness: CWE-787
Which versions are affected by CVE-2022-31364?
It affects 1 product.
Products include Infineon Cypress Bluetooth Mesh Software Development Kit.
How do I fix CVE-2022-31364?
No fix has been published for CVE-2022-31364 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-31364 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31364 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-38v3-cwq5-jprx.