PT-2024-36786 · Matter · Matter

Bob13-Matter · Published 2024-12-18 · Updated 2025-01-02 · CVE-2024-56317

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Matter (also known as connectedhomeip or Project CHIP) versions 1.4.0.0 and earlier

Description The issue concerns the WriteAcl function, which first deletes all existing ACL entries and then attempts to recreate them based on user input. If input validation fails during decoding, the process stops, and no entries are restored, resulting in a denial of service.

Recommendations For Matter versions 1.4.0.0 and earlier, as a temporary workaround, consider disabling the WriteAcl function until a patch is available. Restrict access to the access-control-server.cpp module to minimize the risk of exploitation. Avoid using the WriteAcl function in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-56317

Affected Products

Matter

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-56317 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56317 · Vendor Advisory
• https://github.com/project-chip/connectedhomeip/issues/36535 · Note
• https://twitter.com/VulmonFeeds/status/1869606501813301622 · Twitter Post
• https://twitter.com/CVEnew/status/1869525413086609610 · Twitter Post
• https://t.me/cvedetector/13262 · Telegram Post