KUNBUS piControl vulnerabilities

A race condition vulnerability in the event notification functionality of KUNBUS piControl version 2.6.2. A local authenticated attacker can corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory by issuing concurrent crafted requests from multiple threads through the piControl character device.

In KUNBUS piControl version 2.6.2, a CWE-362 race condition vulnerability exists in the configuration and process-image management functionality. It allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects by sending concurrent crafted requests through the piControl character device, leading to kernel memory corruption and denial of service.

In KUNBUS piControl version 2.6.2, a CWE-787 out-of-bounds write vulnerability exists in the process-image management functionality. It allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the process-image buffer and corrupt adjacent kernel memory, by supplying crafted device configuration data and input through the piControl character device, leading to kernel memory corruption and denial of service.