ARM mbed-os Buffer Overflow Vulnerability Allows Remote Execution of Arbitrary Code
CVE-2024-22905

7HIGH

Key Information:

Vendor

ARM
Status
mbed-os
Vendor
CVE Published:
19 April 2024

What is CVE-2024-22905?

A buffer overflow vulnerability exists in ARM mbed-os versions prior to v.6.17.0, allowing remote attackers to inject and execute arbitrary code. This can occur via a crafted script targeting the hciTrSerialRxIncoming function, posing significant risks to device integrity and security in IoT environments. Users are advised to evaluate their deployments and apply necessary updates.

References

https://github.com/ARMmbed/mbed-os/blob/7c7d20da652788523...
https://github.com/ARMmbed/mbed-os/blob/7c7d20da652788523...
https://github.com/ARMmbed/mbed-os/issues/15462

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.