CVE-2020-27484

Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check for overflow when allocating the array for the NEWA instruction. This a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.

CVSS v3 9.9 CRITICAL
CVSS v2.0 6.5 MEDIUM

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0004.md	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:garmin:forerunner_235_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:garmin:forerunner_235:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-11-16 21:15

Updated : 2024-02-04 21:23

NVD link : CVE-2020-27484

Mitre link : CVE-2020-27484

CVE.ORG link : CVE-2020-27484

JSON object : View

Products Affected

garmin

forerunner_235
forerunner_235_firmware

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2020-27484", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "published": "2020-11-16T21:15:13.377", "references": [{"url": "https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0004.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check for overflow when allocating the array for the NEWA instruction. This a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment."}, {"lang": "es", "value": "Garmin Forerunner 235 versiones anteriores a 8.20, est\u00e1 afectado por: un Desbordamiento de Enteros. El componente es: ConnectIQ TVM. El vector de ataque es: Para explotar la vulnerabilidad, el atacante debe cargar una aplicaci\u00f3n de ConnectIQ maliciosa en la tienda ConnectIQ. El int\u00e9rprete del programa ConnectIQ presenta un fallo al comprobar el desbordamiento al asignar la matriz para la instrucci\u00f3n NEWA. Esta es una primitiva de lectura y escritura restringida en todo el espacio de direcciones MAX32630. Una explotaci\u00f3n con \u00e9xito permitir\u00eda a una aplicaci\u00f3n de la tienda de aplicaciones ConnectIQ escapar y llevar a cabo actividades fuera del entorno de ejecuci\u00f3n de aplicaciones restringido"}], "lastModified": "2020-12-02T15:02:08.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:garmin:forerunner_235_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6043DF86-0FC7-4F8D-A1F4-A8A79BF90099", "versionEndExcluding": "8.20", "versionStartIncluding": "7.90"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:garmin:forerunner_235:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3387D0DB-AB79-4860-B741-CE78FE79139D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}