An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. This value is assumed to be greater than or equal to 3, but the software doesn't ensure that this is the case. Supplying a length less than 3 leads to a buffer overflow in a buffer that is allocated later. It is simultaneously possible to cause another integer overflow by supplying large length values because the provided length value is increased by a few bytes to account for additional information that is supposed to be stored there. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.
CVSS
No CVSS.
References
Configurations
No configuration.
History
20 Nov 2024, 21:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-11-20 21:15
Updated : 2024-11-20 21:15
NVD link : CVE-2024-48982
Mitre link : CVE-2024-48982
CVE.ORG link : CVE-2024-48982
JSON object : View
Products Affected
No product.
CWE
No CWE.