PT-2020-13317 · Arm · Arm Mbed Os
Mjurczak
·
Published
2020-06-18
·
Updated
2020-06-25
·
CVE-2020-12885
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Arm Mbed OS version 5.15.3
Description
An infinite loop was discovered in the CoAP library. The CoAP parser is responsible for parsing received CoAP packets. The function
sn coap parser options parse multiple options() parses CoAP options in a while loop. This loop's exit condition is computed using the previously allocated heap memory required for storing the result of parsing multiple options. If the input heap memory calculation results in zero bytes, the loop exit condition is never met and the loop is not terminated. As a result, the packet parsing function never exits, leading to resource consumption.Recommendations
For Arm Mbed OS version 5.15.3, consider disabling the
sn coap parser options parse multiple options() function until a patch is available to prevent potential resource consumption due to the infinite loop.Fix
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Arm Mbed Os