PT-2024-34712 · Apache · Apache Nimble

Eunkyu Lee · Published 2024-11-26 · Updated 2025-07-08 · CVE-2024-51569

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions through 1.7.0

Description The issue is an Out-of-bounds Read vulnerability in Apache NimBLE. It is caused by missing proper validation of HCI Number Of Completed Packets, which could lead to out-of-bound access when parsing HCI events and invalid read from HCI transport memory. This issue requires a broken or bogus Bluetooth controller and is considered low severity.

Recommendations For Apache NimBLE versions through 1.7.0, users are recommended to upgrade to version 1.8.0, which fixes the issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-51569

Affected Products

Apache Nimble

References · 10

• https://github.com/apache/mynewt-nimble/commit/4e3ac5b6e7c7df63a594c4ff6839e266b4ccfed9 · Patch
• http://openwall.com/lists/oss-security/2024/11/26/5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51569 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51569 · Vendor Advisory
• https://lists.apache.org/thread/q0vs5rddx1lho30xnpsrvpzgxqmywnhs · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1861771618105598106 · Twitter Post
• https://t.me/cvenotify/127974 · Telegram Post
• https://t.me/cvenotify/103293 · Telegram Post
• https://twitter.com/oss_security/status/1861511876724625850 · Twitter Post
• https://twitter.com/CVEnew/status/1861371116729647596 · Twitter Post