PT-2019-15004 · Arm · Arm Mbed Os

Thesilentdawn · Published 2019-11-05 · Updated 2019-11-13 · CVE-2019-17211

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arm Mbed OS version 5.14.0

Description An integer overflow was discovered in the CoAP library. The issue arises from the function sn coap builder calc needed packet data size 2(), which calculates the required memory for the CoAP message. The variables returned byte count and src coap msg ptr->payload len are of type uint16 t. When these values are added together, the result returned byte count can exceed the maximum uint16 t value, causing a wrap-around. This leads to insufficient buffer space being allocated for the corresponding CoAP message.

Recommendations For Arm Mbed OS version 5.14.0, consider modifying the sn coap builder calc needed packet data size 2() function to handle the integer overflow, ensuring sufficient buffer space is allocated for CoAP messages.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2019-17211

Affected Products

Arm Mbed Os

References · 10

• 🔥 https://github.com/ARMmbed/mbed-os/issues/11804 · Exploit
• https://osv.dev/vulnerability/CVE-2019-17211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17211 · Security Note
• https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L355 · Note
• https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L1090 · Note
• https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L710 · Note
• https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L718 · Note
• https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L524 · Note
• https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L527 · Note
• https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L746 · Note