CVE-2018-3972

Published: Sep 26, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An exploitable code execution vulnerability exists in the Levin deserialization functionality of the Epee library, as used in Monero 'Lithium Luna' (v0.12.2.0-master-ffab6700) and other cryptocurrencies. A specially crafted network packet can cause a logic flaw, resulting in code execution. An attacker can send a packet to trigger this vulnerability.

Affected (1)

Products: Getmonero: Monero

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Getmonero Monero	Version 0.12.2.0

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

https://blog.talosintelligence.com/2018/09/epee-levin-vuln.html

Source: talos-cna@cisco.com

Third Party Advisory

https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0637

Source: talos-cna@cisco.com

ExploitThird Party Advisory

https://blog.talosintelligence.com/2018/09/epee-levin-vuln.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0637

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.