CVE-2024-48986

An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L3018	Product
https://github.com/mbed-ce/mbed-os/pull/385	Issue Tracking Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:arm:mbed:6.16.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-11-20 21:15

Updated : 2024-11-26 16:15

NVD link : CVE-2024-48986

Mitre link : CVE-2024-48986

CVE.ORG link : CVE-2024-48986

JSON object : View

Products Affected

arm

mbed

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2024-48986", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-11-20T21:15:08.007", "references": [{"url": "https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L3018", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/mbed-ce/mbed-os/pull/385", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-120"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en MBed OS 6.16.0. Su software de an\u00e1lisis de hci determina din\u00e1micamente la longitud de ciertos paquetes hci leyendo un byte de su encabezado. Ciertos eventos provocan una devoluci\u00f3n de llamada, cuya l\u00f3gica asigna un b\u00fafer (cuya longitud se determina buscando el tipo de evento en una tabla). Sin embargo, la operaci\u00f3n de escritura posterior copia la cantidad de datos especificada en el encabezado del paquete, lo que puede provocar un desbordamiento del b\u00fafer. Este error es f\u00e1cil de explotar para una denegaci\u00f3n de servicio, pero no es seguro que sea suficiente para hacer caer el sistema y, por lo general, no se puede explotar m\u00e1s porque el b\u00fafer explotable se asigna din\u00e1micamente."}], "lastModified": "2024-11-26T16:15:16.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arm:mbed:6.16.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9CE74E6-6FC6-4507-A9EE-F74B3E02FCB8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}