Description
A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attacker-declared SOME/IP length field. This can lead to immediate service termination via OOM-kill on memory-constrained systems or total host memory exhaustion through repeated connections.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| COVESA | vSomeIp | v3.6.1 – < 3.7.4 | 3.7.4 |