Buffer Over-read Vulnerability in Arm Mbed OS CoAP Library

CVE-2020-12884

What is CVE-2020-12884?

A buffer over-read issue exists in the CoAP library of Arm Mbed OS 5.15.3. This vulnerability arises when the CoAP parser processes packets that may contain multiple options. Specifically, the function sn_coap_parser_options_parse_multiple_options() fails to conduct an out-of-bounds check on packet_data_pptr after incrementing it by option_len. While there is a validation check for temp_parsed_uri_query_ptr, it relies on allocated heap memory rather than the actual size of input data. Thus, access can potentially go beyond the intended packet buffer boundary, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References