PT-2020-16691 · Garmin · Connectiq+1

Dion Blazakis · Published 2020-11-16 · Updated 2020-12-02 · CVE-2020-27483

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Garmin Forerunner 235 versions prior to 8.20

Description The issue is related to an array index error in the ConnectIQ TVM component. To exploit this, an attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the offset provided for the stack value duplication instruction, DUP, which is unchecked, allowing memory prior to the start of the execution stack to be read and treated as a TVM object. This could lead to the leak of runtime information, such as heap handles or pointers for TVM context variables, and potentially allow for remote code execution by forging a TVM object on the stack.

Recommendations For Garmin Forerunner 235 versions prior to 8.20, update to version 8.20 or later to resolve the issue. As a temporary workaround, consider restricting the installation of ConnectIQ applications from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2020-27483

Affected Products

Connectiq

Garmin Forerunner 235

References · 5

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0007.md · Exploit
• https://osv.dev/vulnerability/CVE-2020-27483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27483 · Security Note
• https://t.me/cvenotify/5677 · Telegram Post
• https://t.me/cibsecurity/16407 · Telegram Post