CVE-2019-13916 — HIGH (8.8)

Vulnerability Description

An issue was discovered in Cypress (formerly Broadcom) WICED Studio 6.2 CYW20735B1 and CYW20819A1. As a Bluetooth Low Energy (BLE) packet is received, it is copied into a Heap (ThreadX Block) buffer. The buffer allocated in dhmulp_getRxBuffer is four bytes too small to hold the maximum of 255 bytes plus headers. It is possible to corrupt a pointer in the linked list holding the free buffers of the g_mm_BLEDeviceToHostPool Block pool. This pointer can be fully controlled by overflowing with 3 bytes of packet data and the first byte of the packet CRC checksum. The checksum can be freely chosen by adapting the packet data accordingly. An attacker might be able to allocate the overwritten address as a receive buffer resulting in a write-what-where condition. This is fixed in BT SDK2.4 and BT SDK2.45.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Cypress	Wiced Studio	6.2
Cypress	Cyw20735B1	-
Cypress	Cyw20819A1	-

Related Weaknesses (CWE)

CWE-787

References

https://community.cypress.com/thread/53681Permissions RequiredVendor Advisory
https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_13916.mdExploitThird Party Advisory
https://community.cypress.com/thread/53681Permissions RequiredVendor Advisory
https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_13916.mdExploitThird Party Advisory

FAQ

What is CVE-2019-13916?

CVE-2019-13916 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered in Cypress (formerly Broadcom) WICED Studio 6.2 CYW20735B1 and CYW20819A1. As a Bluetooth Low Energy (BLE) packet is received, it is copied into a Heap (ThreadX Block) buffer. ...

How severe is CVE-2019-13916?

CVE-2019-13916 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-13916?

Check the references section above for vendor advisories and patch information. Affected products include: Cypress Wiced Studio, Cypress Cyw20735B1, Cypress Cyw20819A1.