CVE-2024-6638

An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html	Vendor Advisory
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ni:labview::::::::
	cpe:2.3:a:ni:labview:2022:q1::::::
	cpe:2.3:a:ni:labview:2022:q3::::::
	cpe:2.3:a:ni:labview:2022:q3_patch1::::::
	cpe:2.3:a:ni:labview:2022:q3_patch2::::::
	cpe:2.3:a:ni:labview:2023:q1::::::
	cpe:2.3:a:ni:labview:2023:q3::::::
	cpe:2.3:a:ni:labview:2023:q3_patch1::::::
	cpe:2.3:a:ni:labview:2023:q3_patch2::::::
	cpe:2.3:a:ni:labview:2023:q3_patch3::::::
	cpe:2.3:a:ni:labview:2023:q3_patch4::::::
	cpe:2.3:a:ni:labview:2024:q1::::::
	cpe:2.3:a:ni:labview:2024:q1_patch1::::::

History

No history.

Information

Published : 2024-07-22 20:15

Updated : 2025-03-06 19:32

NVD link : CVE-2024-6638

Mitre link : CVE-2024-6638

CVE.ORG link : CVE-2024-6638

JSON object : View

Products Affected

ni

labview

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2024-6638", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-07-22T20:15:04.723", "references": [{"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-190"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de enteros debido a una validaci\u00f3n de entrada incorrecta al leer archivos TDMS en LabVIEW puede resultar en un bucle infinito. La explotaci\u00f3n exitosa requiere que un atacante proporcione al usuario un archivo TDMS especialmente manipulado. Esta vulnerabilidad afecta a LabVIEW 2024 Q1 y versiones anteriores."}], "lastModified": "2025-03-06T19:32:31.013", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "807AE6D5-8096-47A2-A47D-1A5EFC85652D", "versionEndIncluding": "2021"}, {"criteria": "cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D12D6CF-802F-47BA-ADF9-9E52C071BD7F"}, {"criteria": "cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "340F61E5-D1ED-4C29-A894-8BC5C5B90ACE"}, {"criteria": "cpe:2.3:a:ni:labview:2022:q3_patch1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52CC3023-4913-40BA-B74C-786F32DC7551"}, {"criteria": "cpe:2.3:a:ni:labview:2022:q3_patch2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC150E98-5889-4A65-84B8-E4871091D104"}, {"criteria": "cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7DD2022-CFB7-4F38-B459-C1AFB55B5B68"}, {"criteria": "cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18AB0B07-72FE-4861-B69D-AD2E87C5382E"}, {"criteria": "cpe:2.3:a:ni:labview:2023:q3_patch1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91928C9C-F094-4EE4-9FBE-2B7956D68E6F"}, {"criteria": "cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "044C4B51-C641-41F2-ACA0-834C99D63285"}, {"criteria": "cpe:2.3:a:ni:labview:2023:q3_patch3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26EEE5E3-AD37-4832-A66C-5F8F7A478F30"}, {"criteria": "cpe:2.3:a:ni:labview:2023:q3_patch4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DC20B17-C582-42C4-9780-5DC61B4AED91"}, {"criteria": "cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7753CCDF-BAF8-4F91-B85B-EBB2B88F6F30"}, {"criteria": "cpe:2.3:a:ni:labview:2024:q1_patch1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "953E8FD0-4420-4592-B696-C377D4EE0CA2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}