PT-2023-18896 · Garmin · Ciq Api

Published 2023-05-23 · Updated 2023-05-30 · CVE-2023-23301

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CIQ API versions 1.0.0 through 4.1.7

Description The issue arises from the news MonkeyC operation code in the CIQ API, which fails to properly check string resources, allowing them to extend past the expected sections. A malicious CIQ application could exploit this by crafting a string that starts near the end of a section and extends past it, causing the GarminOS TVM component to read out-of-bounds memory.

Recommendations For CIQ API versions 1.0.0 through 4.1.7, as a temporary workaround, consider restricting the use of the news MonkeyC operation code until a patch is available. Avoid using strings that could extend past the end of expected sections in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2023-23301

Affected Products

Ciq Api

References · 3

• 🔥 https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23301.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-23301 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23301 · Vendor Advisory