CVE-2022-39837
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8....
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
- Record
CVE-2022-39837- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
- Record
CVE-2022-39837- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2022-42282
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
- Record
EUVD-2022-42282- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6855-rwxj-9xgr
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8....
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
- Record
GHSA-6855-rwxj-9xgr- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
- Record
CVE-2022-39837- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-39837
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
- Record
DEBIAN-CVE-2022-39837- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-39837
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
- Record
UBUNTU-CVE-2022-39837- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dlt-daemonDebian:12 |
All versions, plus listed versions 2.18.10-12.18.10-102.18.10-112.18.10-122.18.10-12.1 Show 27 moreShow less2.18.10-132.18.10-22.18.10-32.18.10-42.18.10-52.18.10-62.18.10-72.18.10-82.18.10-92.18.11-12.18.11-22.18.11-32.18.11-42.18.11-52.18.8-62.18.9-12.18.9-23.0.0-13.0.0-103.0.0-23.0.0-33.0.0-43.0.0-53.0.0-63.0.0-73.0.0-83.0.0-9 |
None known |
dlt-daemonDebian:13 |
before 2.18.9-1 | 2.18.9-1 |
dlt-daemonDebian:14 |
before 2.18.9-1 | 2.18.9-1 |
dlt-daemonDebian:10 From an advisory covering 4 CVEs |
before 2.18.0-1+deb10u2, plus listed versions 2.18.0-12.18.0-1+deb10u1 |
2.18.0-1+deb10u2 |
dlt-daemonUbuntu:20.04:LTS |
All versions, plus listed versions 2.18.4-0.1 |
None known |
dlt-daemonUbuntu:22.04:LTS |
All versions, plus listed versions 2.18.6-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39837 is a medium vulnerability (CVSS 5.5) in Genivi Diagnostic Log And Trace, published October 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in dlt-daemon 2.18.9-1.
References
seclists.org/fulldisclosure/2022/Sep/24
sec-consult.com/vulnerability-lab/advisory/multiple-memory-corruption-vulnerabilities-in-covesa-dlt-daemon
lists.debian.org/debian-lts-announce/2024/06/msg00021.html
nvd.nist.gov/vuln/detail/CVE-2022-39837
github.com/advisories/GHSA-6855-rwxj-9xgr