PT-2024-29981 · Espressif · Esp-Now

Published 2024-09-12 · Updated 2024-09-12 · CVE-2024-42484

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions ESP-NOW Component (affected versions not specified)

Description The ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound (OOB) vulnerability was discovered in the implementation of the ESP-NOW group type message because there is no check for the addrs num field of the group type message. This can result in memory corruption related attacks. Normally, there are two fields in the group information that need to be checked, i.e., the addrs num field and the addrs list field. Since only the addrs list field is checked, an attacker can send a group type message with an invalid addrs num field, which will cause the message handled by the firmware to be much larger than the current buffer, thus causing a memory corruption issue that goes beyond the payload length.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-42484

GHSA-Q6F6-4QC5-VHX5

Affected Products

Esp-Now

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42484.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-42484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42484 · Security Note
• https://github.com/espressif/esp-now/security/advisories/GHSA-q6f6-4qc5-vhx5 · Note
• https://github.com/espressif/esp-now/commit/b03a1b4593713fa4bf0038a87edca01f10114a7a · Note
• https://twitter.com/CVEnew/status/1834239464933089425 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834273910323376302 · Twitter Post
• https://t.me/cvedetector/5491 · Telegram Post