CVE-2024-48983

An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet header. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier plus the header length. WsfMsgAlloc then increments this again by sizeof(wsfMsg_t). This may cause an integer overflow that results in the buffer being significantly too small to contain the entire packet. This may cause a buffer overflow of up to 65 KB . This bug is trivial to exploit for a denial of service but can generally not be exploited further because the exploitable buffer is dynamically allocated.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/wsf/sources/port/baremetal/wsf_msg.c#L72	Product
https://github.com/mbed-ce/mbed-os/pull/388	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:arm:mbed:6.16.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-11-20 20:15

Updated : 2024-11-25 21:15

NVD link : CVE-2024-48983

Mitre link : CVE-2024-48983

CVE.ORG link : CVE-2024-48983

JSON object : View

Products Affected

arm

mbed

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2024-48983", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-11-20T20:15:19.183", "references": [{"url": "https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/wsf/sources/port/baremetal/wsf_msg.c#L72", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/mbed-ce/mbed-os/pull/388", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet header. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier plus the header length. WsfMsgAlloc then increments this again by sizeof(wsfMsg_t). This may cause an integer overflow that results in the buffer being significantly too small to contain the entire packet. This may cause a buffer overflow of up to 65 KB . This bug is trivial to exploit for a denial of service but can generally not be exploited further because the exploitable buffer is dynamically allocated."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en MBed OS 6.16.0. Durante el procesamiento de paquetes HCI, el software determina din\u00e1micamente la longitud de los datos del paquete leyendo 2 bytes del encabezado del paquete. Luego se asigna un b\u00fafer para contener el paquete completo, cuyo tama\u00f1o se calcula como la longitud del cuerpo del paquete determinado anteriormente m\u00e1s la longitud del encabezado. WsfMsgAlloc luego incrementa esto nuevamente en sizeof(wsfMsg_t). Esto puede causar un desbordamiento de enteros que da como resultado que el b\u00fafer sea significativamente demasiado peque\u00f1o para contener el paquete completo. Esto puede causar un desbordamiento de b\u00fafer de hasta 65 KB. Este error es trivial de explotar para una denegaci\u00f3n de servicio, pero generalmente no se puede explotar m\u00e1s porque el b\u00fafer explotable se asigna din\u00e1micamente."}], "lastModified": "2024-11-25T21:15:17.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arm:mbed:6.16.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9CE74E6-6FC6-4507-A9EE-F74B3E02FCB8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}