Description (CNA)
TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| tier4 / nebula | affected 0 through 1.2.0 |
CWE
CWE-125
References
- https://github.com/tier4/nebula/issues/488
- https://www.vulncheck.com/advisories/tier-iv-nebula-heap-out-of-bounds-read-via-vlp32-udp-decoder
ADP enrichment
No English description supplied.
No references supplied.