[Security] GET_LOG_INFO V2 heap-buffer-overflow — responsible disclosure

[sgInnora]

I have identified a security vulnerability in dlt-daemon affecting the DLT V2 protocol parsing (dlt_daemon_control_get_log_info_v2). I am following responsible disclosure and have sent details privately to the BMW security team (cert@bmw.de) and the primary maintainer.

Vulnerability: CWE-125 Out-of-bounds Read in GET_LOG_INFO V2 message parsing
Severity: Critical (CVSS 9.1)
Affected: dlt-daemon v3.0.1 (HEAD) and prior versions with DLT V2 support
Status: Private technical details shared with cert@bmw.de — awaiting acknowledgement

I will coordinate a public disclosure timeline with maintainers.

Reporter: Feng Ning feng@innora.ai / Innora Security Research

[sgInnora]

Update: Additional investigation reveals this is a systemic vulnerability cluster affecting at least 2 DLT V2 service handlers, not just GET_LOG_INFO_V2:

1. dlt_daemon_control_get_log_info_v2 (line 2098): OOB READ via apidlen/ctidlen — ASAN CONFIRMED
2. dlt_daemon_control_set_log_level_v2 (line 3660): IDENTICAL pattern — ASAN CONFIRMED

Both use DLT_SERVICE_*_FIXED_SIZE_V2 = 11 as the minimum size check, but neither validates that db_offset + apidlen <= msg->datasize before calling dlt_set_id_v2().

Root fix should be applied systematically to ALL DLT V2 service handlers that read variable-length apidlen/ctidlen fields.

Full technical report sent privately to cert@bmw.de.