PT-2019-15005 · Arm · Arm Mbed Os
Thesilentdawn
·
Publicado
2019-11-05
·
Atualizado
2020-08-24
·
CVE-2019-17212
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Arm Mbed OS version 5.14.0
Description
A buffer overflow issue was discovered in the CoAP library of Arm Mbed OS. The CoAP parser, specifically the function
sn coap parser options parse(), is responsible for parsing received CoAP packets. The issue arises from the lack of strict enforcement of the *packet data pptr value within the while loop, allowing it to be increased and then dereferenced without proper bounds checking. This, along with similar issues in other sn coap parser ****() functions, can lead to heap-based or stack-based buffer overflows, depending on the allocation of the CoAP packet buffer.Recommendations
For Arm Mbed OS version 5.14.0, consider disabling the
sn coap parser options parse() function until a patch is available to prevent potential buffer overflows. Additionally, restrict the use of other sn coap parser ****() functions that do not properly check the bounds of the allocated buffer to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Improper Validation of Array Index
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Arm Mbed Os