Vulnerability · Published Apr 19, 2024 · Assigned by VulDB
CVE-2024-3979COVESA vsomeip race condition
Medium 4.4
In plain English
A medium-severity race condition in vsomeip from COVESA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.2%top 91.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261596.
Affected products (as reported)
Weakness: CWE-362 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- VDB-261596 | COVESA vsomeip race condition vdb-entry
- VDB-261596 | CTI Indicators (IOB, IOC) signature, permissions-required
- Submit #312410 | Bayerische Motoren Werke Aktiengesellschaft vsomeip 3.4.10 Concurrency Bug third-party-advisory
- https://github.com/COVESA/vsomeip/issues/663 issue-tracking
- https://github.com/COVESA/vsomeip/files/14904610/details.zip exploit