PT-2024-25016 · Matter · Matter

Bela Genge · Published 2024-07-24 · Updated 2024-09-10 · CVE-2024-3297

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Matter protocol versions prior to 1.1

Description The issue is related to the Certificate Authenticated Session Establishment (CASE) protocol, which is used for establishing secure sessions between two devices. It allows an attacker to replay manipulated CASE Sigma1 messages, making the device unresponsive until it is power-cycled.

Recommendations For Matter protocol versions prior to 1.1, consider disabling the Certificate Authenticated Session Establishment (CASE) protocol until a patch is available. Restrict access to the device to minimize the risk of exploitation. Avoid using the device until the issue is resolved.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-3297

Affected Products

Matter

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-3297 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3297 · Vendor Advisory
• https://t.me/cvenotify/93999 · Telegram Post
• https://bitdefender.com/support/security-advisories/session-establishment-lock-up-during-replay-of-case-sigma1-messages · Note
• https://t.me/cvenotify/87216 · Telegram Post
• https://t.me/cvedetector/1552 · Telegram Post