PT-2024-32494 · Apache · Apache Nimble

Eunkyu Lee · Published 2024-11-26 · Updated 2025-07-08 · CVE-2024-47249

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions through 1.7.0

Description The issue is related to improper validation of array indices in Apache NimBLE, which could result in out-of-bound memory corruption and crash due to lack of input validation for HCI events from the controller. This problem requires a broken or bogus Bluetooth controller and is considered low severity.

Recommendations For Apache NimBLE versions through 1.7.0, users are recommended to upgrade to version 1.8.0, which fixes the issue.

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2024-47249

Affected Products

Apache Nimble

References · 10

• https://github.com/apache/mynewt-nimble/commit/f39330866a85fa4de49246e9d21334bc8d14f0a1 · Patch
• https://osv.dev/vulnerability/CVE-2024-47249 · Vendor Advisory
• http://openwall.com/lists/oss-security/2024/11/26/3 · Vendor Advisory
• https://lists.apache.org/thread/7ckxw6481dp68ons627pjcb27c75n0mq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47249 · Security Note
• https://twitter.com/VulmonFeeds/status/1861776738386079781 · Twitter Post
• https://twitter.com/CVEnew/status/1861371119040594378 · Twitter Post
• https://t.me/cvenotify/127972 · Telegram Post
• https://twitter.com/oss_security/status/1861511874405171206 · Twitter Post
• https://t.me/cvenotify/103291 · Telegram Post