CVE-2019-17210

A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString() is called by the function MQTTDeserialize_publish() to get the length and content of the MQTT topic name. In the function readMQTTLenString(), mqttstring->lenstring.len is a part of user input, which can be manipulated. An attacker can simply change it to a larger value to invalidate the if statement so that the statements inside the if statement are skipped, letting the value of mqttstring->lenstring.data default to zero. Later, curn is accessed, which points to mqttstring->lenstring.data. On an Arm Cortex-M chip, the value at address 0x0 is actually the initialization value for the MSP register. It is highly dependent on the actual firmware. Therefore, the behavior of the program is unpredictable from this time on.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/ARMmbed/mbed-os/issues/11802	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:arm:mbed-mqtt:2017-11-02:*:*:*:*:*:*:*

cpe:2.3:o:arm:mbed-os:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-11-04 20:15

Updated : 2024-02-04 20:39

NVD link : CVE-2019-17210

Mitre link : CVE-2019-17210

CVE.ORG link : CVE-2019-17210

JSON object : View

Products Affected

arm

mbed-os
mbed-mqtt

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2019-17210", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-11-04T20:15:10.027", "references": [{"url": "https://github.com/ARMmbed/mbed-os/issues/11802", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString() is called by the function MQTTDeserialize_publish() to get the length and content of the MQTT topic name. In the function readMQTTLenString(), mqttstring->lenstring.len is a part of user input, which can be manipulated. An attacker can simply change it to a larger value to invalidate the if statement so that the statements inside the if statement are skipped, letting the value of mqttstring->lenstring.data default to zero. Later, curn is accessed, which points to mqttstring->lenstring.data. On an Arm Cortex-M chip, the value at address 0x0 is actually the initialization value for the MSP register. It is highly dependent on the actual firmware. Therefore, the behavior of the program is unpredictable from this time on."}, {"lang": "es", "value": "Se detect\u00f3 un problema de denegaci\u00f3n de servicio en la biblioteca MQTT en Arm Mbed OS en 02-11-2017. La funci\u00f3n MQTTDeserialize_publish() es llamada por la funci\u00f3n readMQTTLenString() para conseguir la longitud y el contenido del nombre del tema MQTT. En la funci\u00f3n readMQTTLenString(), mqttstring-)lenstring.len es una parte de la entrada del usuario, que puede ser manipulada. Un atacante puede simplemente cambiarlo a un valor mas grande para invalidar la sentencia if de manera que las sentencias dentro de la sentencia if sean omitidas, dejando el valor de mqttstring-)lenstring.data predeterminado en cero. M\u00e1s tarde, curn es accedida, la cual apunta a mqttstring-)lenstring.data. En un chip DE Arm Cortex-M, el valor en la direcci\u00f3n 0x0 es realmente el valor de inicializaci\u00f3n para el registro MSP. Este es muy dependiente del firmware actual. Por lo tanto, el comportamiento del programa es impredecible desde este momento."}], "lastModified": "2019-11-13T14:51:49.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arm:mbed-mqtt:2017-11-02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AF5DAF9-FBAD-417F-8A1C-BB53E0963586"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arm:mbed-os:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C018C01-0E0A-4DAD-96ED-E9F471AE9E5F"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}