CVE Vulnerabilities

CVE-2022-30792

Uncontrolled Resource Consumption

Published: Jul 11, 2022 | Modified: Sep 23, 2022
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected.

Weakness

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Affected Software

Name Vendor Start Version End Version
Control_for_beaglebone Codesys * 4.5.0.0 (excluding)
Control_for_empc-a/imx6 Codesys * 4.5.0.0 (excluding)
Control_for_iot2000_sl Codesys * 4.6.0.0 (excluding)
Control_for_linux_sl Codesys * 4.5.0.0 (excluding)
Control_for_pfc100_sl Codesys * 4.5.0.0 (excluding)
Control_for_pfc200_sl Codesys * 4.5.0.0 (excluding)
Control_for_plcnext Codesys * 4.6.0.0 (excluding)
Control_for_raspberry_pi_sl Codesys * 4.5.0.0 (excluding)
Control_for_wago_touch_panels_600 Codesys * 4.5.0.0 (excluding)
Control_rte_sl Codesys * 3.5.18.20 (excluding)
Control_rte_sl_(for_beckhoff_cx) Codesys * 3.5.18.20 (excluding)
Control_runtime_system_toolkit Codesys * 3.5.18.20 (excluding)
Control_win Codesys * 3.5.18.20 (excluding)
Development_system Codesys * 3.5.18.20 (excluding)
Edge_gateway Codesys * 3.5.18.20 (excluding)
Edge_gateway Codesys * 4.5.0.0 (excluding)
Embedded_target_visu_toolkit Codesys * 3.5.18.20 (excluding)
Gateway Codesys * 3.5.18.20 (excluding)
Hmi Codesys * 3.5.18.20 (excluding)
Remote_target_visu_toolkit Codesys * 3.5.18.20 (excluding)

Extended Description

Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system. There are at least three distinct scenarios which can commonly lead to resource exhaustion:

Resource exhaustion problems are often result due to an incorrect implementation of the following situations:

Potential Mitigations

  • Mitigation of resource exhaustion attacks requires that the target system either:

  • The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.

  • The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.

References