Denial-of-Service Vulnerability in MQTT Library of Arm Mbed OS

CVE-2019-17210

Summary

A denial-of-service issue was identified in the MQTT library of Arm Mbed OS version 2017-11-02. The vulnerability arises when the function readMQTTLenString() is utilized to obtain the length and content of the MQTT topic name, where user input can be manipulated to yield larger values than intended. This manipulation leads to unpredictable behavior in the program as the mqttstring->lenstring.data defaults to zero after bypassing crucial validations. Such an incident can result in accessing a memory address that could compromise the functioning of applications relying on the library, particularly on Arm Cortex-M chips.

References