Out-of-bounds Read Vulnerability in Apache NimBLE Could Lead to Invalid Memory Access
CVE-2024-51569

Currently unrated

Key Information:

Vendor
Apache
Status
Apache Nimble
Vendor
CVE Published:
26 November 2024

Summary

Out-of-bounds Read vulnerability in Apache NimBLE.

Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI transport memory. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Affected Version(s)

Apache NimBLE 0 <= 1.7.0

References

https://lists.apache.org/thread/q0vs5rddx1lho30xnpsrvpzgx...
vendor-advisory
https://github.com/apache/mynewt-nimble/commit/4e3ac5b6e7...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eunkyu Lee
.