Sign-up

ID

VAR-202209-1748


CVE

CVE-2022-3349


TITLE

Sony Interactive Entertainment Inc.  playstation 4  firmware and  playstation 5  Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2022-018132

DESCRIPTION

A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the component exFAT Handler. The manipulation of the argument dataLength leads to heap-based buffer overflow. It is possible to launch the attack on the physical device. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-209679. Sony Interactive Entertainment Inc. playstation 4 firmware and playstation 5 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Sony PlayStation is a series of home game consoles produced by Sony Corporation of Japan. The vulnerability is due to the lack of length verification of the parameter dataLength

Trust: 2.16

sources: NVD: CVE-2022-3349 // JVNDB: JVNDB-2022-018132 // CNVD: CNVD-2022-88790

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-88790

AFFECTED PRODUCTS

vendor:sonymodel:playstation 4scope:eqversion: -

Trust: 1.0

vendor:sonymodel:playstation 5scope:eqversion: -

Trust: 1.0

vendor:株式会社ソニー インタラクティブエンタテインメントmodel:playstation 4scope: - version: -

Trust: 0.8

vendor:株式会社ソニー インタラクティブエンタテインメントmodel:playstation 5scope: - version: -

Trust: 0.8

vendor:sonymodel:playstation 5scope: - version: -

Trust: 0.6

vendor:sonymodel:playstation 4scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2022-88790 // JVNDB: JVNDB-2022-018132 // NVD: CVE-2022-3349

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-3349
value: MEDIUM

Trust: 1.0

cna@vuldb.com: CVE-2022-3349
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-3349
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-88790
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202209-2846
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2022-88790
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-3349
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2022-3349
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-88790 // JVNDB: JVNDB-2022-018132 // CNNVD: CNNVD-202209-2846 // NVD: CVE-2022-3349 // NVD: CVE-2022-3349

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-018132 // NVD: CVE-2022-3349

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202209-2846

EXTERNAL IDS

db:NVDid:CVE-2022-3349

Trust: 3.8

db:HACKERONEid:1340942

Trust: 3.0

db:VULDBid:209679

Trust: 1.6

db:JVNDBid:JVNDB-2022-018132

Trust: 0.8

db:CNVDid:CNVD-2022-88790

Trust: 0.6

db:CNNVDid:CNNVD-202209-2846

Trust: 0.6

sources: CNVD: CNVD-2022-88790 // JVNDB: JVNDB-2022-018132 // CNNVD: CNNVD-202209-2846 // NVD: CVE-2022-3349

REFERENCES

url:https://hackerone.com/reports/1340942

Trust: 3.0

url:https://vuldb.com/?id.209679

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2022-3349

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-3349/

Trust: 0.6

sources: CNVD: CNVD-2022-88790 // JVNDB: JVNDB-2022-018132 // CNNVD: CNNVD-202209-2846 // NVD: CVE-2022-3349

SOURCES

db:CNVDid:CNVD-2022-88790
db:JVNDBid:JVNDB-2022-018132
db:CNNVDid:CNNVD-202209-2846
db:NVDid:CVE-2022-3349

LAST UPDATE DATE

2024-08-14T14:10:33.273000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-88790date:2022-12-20T00:00:00
db:JVNDBid:JVNDB-2022-018132date:2023-10-18T08:12:00
db:CNNVDid:CNNVD-202209-2846date:2022-10-08T00:00:00
db:NVDid:CVE-2022-3349date:2023-11-07T03:51:09.147

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-88790date:2022-12-15T00:00:00
db:JVNDBid:JVNDB-2022-018132date:2023-10-18T00:00:00
db:CNNVDid:CNNVD-202209-2846date:2022-09-28T00:00:00
db:NVDid:CVE-2022-3349date:2022-09-28T13:15:10.007