An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. This value is assumed to be greater than or equal to 3, but the software doesn't ensure that this is the case. Supplying a length less than 3 leads to a buffer overflow in a buffer that is allocated later. It is simultaneously possible to cause another integer overflow by supplying large length values because the provided length value is increased by a few bytes to account for additional information that is supposed to be stored there. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.
History

Mon, 25 Nov 2024 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Mbed
Mbed mbed
CPEs cpe:2.3:o:mbed:mbed:6.16.0:*:*:*:*:*:*:*
Vendors & Products Mbed
Mbed mbed
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 22 Nov 2024 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Arm
Arm mbed
Weaknesses CWE-120
CPEs cpe:2.3:o:arm:mbed:6.16.0:*:*:*:*:*:*:*
Vendors & Products Arm
Arm mbed
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}


Wed, 20 Nov 2024 20:30:00 +0000

Type Values Removed Values Added
Description An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. This value is assumed to be greater than or equal to 3, but the software doesn't ensure that this is the case. Supplying a length less than 3 leads to a buffer overflow in a buffer that is allocated later. It is simultaneously possible to cause another integer overflow by supplying large length values because the provided length value is increased by a few bytes to account for additional information that is supposed to be stored there. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-11-20T00:00:00

Updated: 2024-11-25T21:03:47.200Z

Reserved: 2024-10-11T00:00:00

Link: CVE-2024-48982

cve-icon Vulnrichment

Updated: 2024-11-25T21:01:47.684Z

cve-icon NVD

Status : Modified

Published: 2024-11-20T21:15:07.830

Modified: 2024-11-25T21:15:17.023

Link: CVE-2024-48982

cve-icon Redhat

No data.