PT-2020-16694 · Garmin · Connectiq+1

Dion Blazakis · Published 2020-11-16 · Updated 2020-12-02 · CVE-2020-27486

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Garmin Forerunner 235 versions prior to 8.20

Description The issue is related to a buffer overflow in the ConnectIQ TVM component. To exploit this, an attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the string length provided in the data section of the PRG file, allocates memory for the string, and then copies the string into the TVM object using a function similar to strcpy(). This can lead to overwriting heap data if the copy exceeds the allocated string length. A successful exploit allows a ConnectIQ app store application to escape its restricted environment and perform unauthorized activities.

Recommendations For Garmin Forerunner 235 versions prior to 8.20, update to version 8.20 or later to resolve the issue. As a temporary workaround, consider restricting the installation of ConnectIQ applications from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-27486

Affected Products

Connectiq

Garmin Forerunner 235

References · 5

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0006.md · Exploit
• https://osv.dev/vulnerability/CVE-2020-27486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27486 · Security Note
• https://t.me/cvenotify/5667 · Telegram Post
• https://t.me/cibsecurity/16412 · Telegram Post