Buffer Over-Reads in CoAP Library of Arm Mbed OS

CVE-2020-12883

Summary

A vulnerability was identified in the CoAP library of Arm Mbed OS 5.15.3, where buffer over-reads can occur during CoAP packet parsing. The issue arises in the function responsible for parsing options, which fails to properly verify the input packet length against the number of bytes read. This results in access to memory locations either on the heap or stack outside the intended boundary of the buffer, potentially leading to unauthorized memory access or processing of unintended inputs. Depending on the platform's memory management, this flaw could lead to system instability and security breaches.

References