Loading vulnerability…
Heap-Based Buffer Overflow in RCDCAP ERSPAN and HP ERM Packet Processing
CVE-2021-37222 is a wildcopy heap-based buffer overflow in the open-source RCDCAP packet parsers before version 1.0.5. The flaw affects ERSPANProcessor::processImpl and HPERMProcessor::processImpl while processing Cisco ERSPAN and HP ERM encapsulated traffic. Specially crafted packets can corrupt memory and crash the application, and may potentially enable arbitrary code execution. Microsoft Defender for IoT sensor deployments that use the affected RCDCAP component are exposed when processing this traffic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker may cause memory corruption and an application crash, resulting in denial of service. Successful exploitation may also potentially permit arbitrary code execution in the context of the vulnerable packet-processing component.
If you can’t patch tonight, do this now.
Patch affected systems immediately. Until patching is complete, restrict untrusted traffic capable of reaching the affected packet-processing path where operationally feasible and monitor Defender for IoT sensor availability for unexpected crashes.
Patch, then assume compromise.
Upgrade RCDCAP to version 1.0.5 or later, incorporating the upstream fix for the vulnerable packet parsers. Apply available vendor security updates for affected Defender for IoT deployments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.