PT-2024-36787 · Matter · Matter

Bob13-Matter · Published 2024-12-18 · Updated 2025-01-02 · CVE-2024-56318

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Matter (aka connectedhomeip or Project CHIP) versions 1.4.0.0 and earlier, before 27ca6ec

Description The issue is related to a NULL pointer dereference in TCPBase::ProcessSingleMessage via TCP packets with zero messageSize, leading to denial of service. This occurs in the rawTCP.cpp file of the affected software.

Recommendations For Matter (aka connectedhomeip or Project CHIP) versions 1.4.0.0 and earlier, before 27ca6ec, update to a version that includes the fix for the NULL pointer dereference issue in TCPBase::ProcessSingleMessage. As a temporary workaround, consider restricting the handling of TCP packets with zero messageSize to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2024-56318

Affected Products

Matter

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-56318 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56318 · Vendor Advisory
• https://github.com/project-chip/connectedhomeip/pull/36751 · Note
• https://github.com/project-chip/connectedhomeip/issues/36750 · Note
• https://github.com/project-chip/connectedhomeip/commit/27ca6ec255b78168e04bd71e0f1a473869cf144b · Note
• https://t.me/cvedetector/13263 · Telegram Post
• https://twitter.com/CVEnew/status/1869525414458048555 · Twitter Post
• https://t.me/cvenotify/104835 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1869603941681373306 · Twitter Post