CVE-2022-39836
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8....
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
- Record
CVE-2022-39836- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
- Record
CVE-2022-39836- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2022-42281
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
- Record
EUVD-2022-42281- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8gjv-jwgc-cx6r
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8....
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
- Record
GHSA-8gjv-jwgc-cx6r- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
- Record
CVE-2022-39836- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-39836
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
- Record
DEBIAN-CVE-2022-39836- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-39836
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
- Record
UBUNTU-CVE-2022-39836- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dlt-daemonDebian:12 |
All versions, plus listed versions 2.18.10-12.18.10-102.18.10-112.18.10-122.18.10-12.1 Show 27 moreShow less2.18.10-132.18.10-22.18.10-32.18.10-42.18.10-52.18.10-62.18.10-72.18.10-82.18.10-92.18.11-12.18.11-22.18.11-32.18.11-42.18.11-52.18.8-62.18.9-12.18.9-23.0.0-13.0.0-103.0.0-23.0.0-33.0.0-43.0.0-53.0.0-63.0.0-73.0.0-83.0.0-9 |
None known |
dlt-daemonDebian:13 |
before 2.18.9-1 | 2.18.9-1 |
dlt-daemonDebian:14 |
before 2.18.9-1 | 2.18.9-1 |
dlt-daemonDebian:10 From an advisory covering 4 CVEs |
before 2.18.0-1+deb10u2, plus listed versions 2.18.0-12.18.0-1+deb10u1 |
2.18.0-1+deb10u2 |
dlt-daemonUbuntu:20.04:LTS |
All versions, plus listed versions 2.18.4-0.1 |
None known |
dlt-daemonUbuntu:22.04:LTS |
All versions, plus listed versions 2.18.6-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39836 is a medium vulnerability (CVSS 5.5) in Genivi Diagnostic Log And Trace, published October 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in dlt-daemon 2.18.9-1.
References
seclists.org/fulldisclosure/2022/Sep/24
sec-consult.com/vulnerability-lab/advisory/multiple-memory-corruption-vulnerabilities-in-covesa-dlt-daemon
lists.debian.org/debian-lts-announce/2024/06/msg00021.html
nvd.nist.gov/vuln/detail/CVE-2022-39836
github.com/advisories/GHSA-8gjv-jwgc-cx6r