Vulnerability Description
An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arm | Mbed | 6.16.0 |
Related Weaknesses (CWE)
References
- https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941fProduct
- https://github.com/mbed-ce/mbed-os/pull/385Issue TrackingPatchVendor Advisory
FAQ
What is CVE-2024-48986?
CVE-2024-48986 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the log...
How severe is CVE-2024-48986?
CVE-2024-48986 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-48986?
Check the references section above for vendor advisories and patch information. Affected products include: Arm Mbed.