EVerest has out-of-bounds read in DZG_GSH01 SLIP CRC parser that can crash powermeter driver
Résumé
EVerest has out-of-bounds read in DZG_GSH01 SLIP CRC parser that can crash powermeter driver
Description d'origine
La description telle que publiée par la source (souvent en anglais).
EVerest is an EV charging software stack. Prior to version 2025.12.0, is_message_crc_correct in the DZG_GSH01 powermeter SLIP parser reads vec[vec.size()-1] and vec[vec.size()-2] without checking that at least two bytes are present. Malformed SLIP frames on the serial link can reach is_message_crc_correct with vec.size() < 2 (only via the multi-message path), causing an out-of-bounds read before CRC verification and pop_back underflow. Therefore, an attacker controlling the serial input can reliably crash the process. Version 2025.12.0 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com