Infinite Loop in CoAP Library of Arm Mbed OS 5.15.3

CVE-2020-12885

What is CVE-2020-12885?

An infinite loop vulnerability exists in the CoAP library of Arm Mbed OS 5.15.3, specifically within the sn_coap_parser_options_parse_multiple_options() function. This function is responsible for parsing CoAP packets and, due to a flaw in the loop's exit condition, can enter an endless loop. This occurs when the calculated heap memory required to store parsed options equates to zero bytes, causing the loop to never terminate. The result is excessive resource consumption that can lead to degraded performance or service denial.

References