ID
VAR-202411-1444
CVE
CVE-2024-48982
TITLE
ARM Ltd. of Mbed OS Classic buffer overflow vulnerability in
Trust: 0.8
DESCRIPTION
An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. This value is assumed to be greater than or equal to 3, but the software doesn't ensure that this is the case. Supplying a length less than 3 leads to a buffer overflow in a buffer that is allocated later. It is simultaneously possible to cause another integer overflow by supplying large length values because the provided length value is increased by a few bytes to account for additional information that is supposed to be stored there. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated. ARM Ltd. of Mbed OS Exists in a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state
Trust: 1.62
AFFECTED PRODUCTS
| vendor: | arm | model: | mbed | scope: | eq | version: | 6.16.0 | Trust: 1.0 |
| vendor: | arm | model: | mbed os | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | arm | model: | mbed os | scope: | - | version: | - | Trust: 0.8 |
| vendor: | arm | model: | mbed os | scope: | eq | version: | 6.16.0 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-120 | Trust: 1.0 |
| problemtype: | Classic buffer overflow (CWE-120) [NVD evaluation ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-48982 | Trust: 2.6 |
| db: | JVNDB | id: | JVNDB-2024-013267 | Trust: 0.8 |
REFERENCES
| url: | https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/feature_ble/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#l2748 | Trust: 1.8 |
| url: | https://github.com/mbed-ce/mbed-os/pull/386 | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-48982 | Trust: 0.8 |
SOURCES
| db: | JVNDB | id: | JVNDB-2024-013267 |
| db: | NVD | id: | CVE-2024-48982 |
LAST UPDATE DATE
2024-11-26T23:12:40.889000+00:00
SOURCES UPDATE DATE
| db: | JVNDB | id: | JVNDB-2024-013267 | date: | 2024-11-25T01:03:00 |
| db: | NVD | id: | CVE-2024-48982 | date: | 2024-11-25T21:15:17.023 |
SOURCES RELEASE DATE
| db: | JVNDB | id: | JVNDB-2024-013267 | date: | 2024-11-25T00:00:00 |
| db: | NVD | id: | CVE-2024-48982 | date: | 2024-11-20T21:15:07.830 |