Vulnerability Description
Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI transport memory. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Nimble | < 1.8.0 |
Related Weaknesses (CWE)
References
- https://github.com/apache/mynewt-nimble/commit/4e3ac5b6e7c7df63a594c4ff6839e266bPatch
- https://lists.apache.org/thread/q0vs5rddx1lho30xnpsrvpzgxqmywnhsVendor Advisory
- http://www.openwall.com/lists/oss-security/2024/11/26/5Mailing ListVendor Advisory
FAQ
What is CVE-2024-51569?
CVE-2024-51569 is a vulnerability with a CVSS score of 7.5 (HIGH). Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI tran...
How severe is CVE-2024-51569?
CVE-2024-51569 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-51569?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Nimble.