Description

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T18:18:14.170Z",
  "pubdate": "2026-08-17T18:18:14.170Z",
  "executiveSummary": "COVESA Open1722 through versions 0.9.2 contains an integer truncation vulnerability located in the acf-can-listener.c component.\nThe vulnerability allows unauthenticated remote attackers to trigger an information disclosure condition, causing the CAN listener to broadcast process stack memory contents onto the connected CAN bus.\nThis high-severity flaw exposes sensitive internal process memory, presenting severe privacy and system integrity risks in automotive and embedded networking environments.\nUnauthenticated remote attackers can exploit this issue by transmitting crafted UDP datagrams over the network.\nSuccessful exploitation requires the transmission of a rejected UDP datagram containing an AVTP stream ID that matches the expected listener configuration, requiring no prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of the vulnerability resides in improper type handling of the num_can_msgs variable within the acf-can-listener.c file.\nSpecifically, the num_can_msgs variable is declared as a uint8_t data type, which is incapable of correctly holding negative integer return values.\nWhen the internal function avtp_to_can() encounters an error condition and returns a negative error code such as -1, assignment to the uint8_t variable results in integer truncation.\nThis truncation converts the -1 error value into 255.\nSubsequently, this truncated value controls a write loop designed to process CAN messages.\nRather than handling the error safely or terminating execution, the loop iterates 255 times.\nDuring this out-of-bounds iteration, the loop reads from a fixed 15-slot stack array within the process memory space.\nThis bounds mismatch results in the leakage of approximately 18 kilobytes of adjacent stack memory.\nThe leaked memory payload is packaged and transmitted as roughly 240 CAN frames across the CAN bus.\nAny recipient node monitoring the CAN bus can capture these frames, exposing sensitive stack contents to unauthorized observers.\nThe attack flow begins when an unauthenticated remote attacker sends a specially crafted UDP datagram across the network.\nThe UDP datagram is configured with an AVTP stream ID that matches the targeted listener.\nUpon receipt, the listener rejects the datagram, triggering the error handling path within avtp_to_can().\nThe resulting -1 error code is improperly cast and truncated due to the uint8_t variable definition.\nThe subsequent memory-reading loop executes excessively, reading stack memory out of bounds and dispatching the resulting data onto the CAN bus interface without requiring authentication, specific privileges, or complex local access."
}