Buffer Overflow Vulnerability in MBed OS from Arm

CVE-2024-48983

Summary

A vulnerability in MBed OS 6.16.0 can lead to a buffer overflow when processing HCI packets. The software calculates the length of packet data based on two bytes from the packet header, allocating a buffer to accommodate the entire packet's size, which includes the packet body and the header. Due to a flaw in this length calculation, an integer overflow could occur, resulting in a dynamically allocated buffer that is insufficient to hold the packet, potentially leading to a buffer overflow of up to 65 KB. While this vulnerability is primarily exploitable for causing denial of service, its exploitability is limited due to the dynamic nature of the buffer allocation.

References