NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ls/nut/security/advisories/GHSA-fjxc-2vpv-mqc8 Diğer
• github.com/networkupstools/nut/pull/3529 Diğer
• github.com/…ommit/30d56d4282f823949b40763d5c76461c7dd107b3 Diğer

Kayıt geçmişi

1. 6 Kas 2026 01:57Yayımlandı

İlgili açıklar

• 8,1 CVE-2026-54161Network UPS Tools (NUT) upsmon: ups.alarm değeri üzerinden OS komut enjeksiyonu
• 6,9 CVE-2026-54913WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest
• 6,9 CVE-2026-118448Uninitialized output buffer returned after nd_to_text failure in pybddisasm
• 4,8 CVE-2026-118447Uninitialized INSTRUX contents returned after decoding failure in pybddisasm
• 7,5 CVE-2026-120061psqlODBC ODBC kaçış ayrıştırıcısında yığın taşması (stack buffer overflow)
• 5,5 CVE-2026-120246FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder