Vulnerability Details CVE-2022-40278
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sqlite3_free after sqlite3_exec, leading to a denial of service.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 37.7%
CVSS Severity
CVSS v3 Score 7.5
References
- https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L103
- https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L107
- https://github.com/Samsung/TizenRT/issues/5628
- https://www.sqlite.org/c3ref/exec.html
- https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L103
- https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L107
- https://github.com/Samsung/TizenRT/issues/5628
- https://www.sqlite.org/c3ref/exec.html
Products affected by CVE-2022-40278
-
cpe:2.3:o:samsung:tizenrt:1.0
-
cpe:2.3:o:samsung:tizenrt:1.1
-
cpe:2.3:o:samsung:tizenrt:2.0
-
cpe:2.3:o:samsung:tizenrt:3.0
-
cpe:2.3:o:samsung:tizenrt:3.1