CVE-2019-18614

On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow, an attacker can either send packets over the air or as unprivileged local user. Over the air, the minimal PoC is sending "l2ping -s 600" to the target address prior to any pairing. Locally, the buffer overflow is immediately triggered by opening an ACL or SCO connection to a headset. This occurs because, in WICED Studio 6.2 and 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE and BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE are set to 384.

CVSS v3 7.8 HIGH
CVSS v2.0 4.6 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_18614.md	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cypress:cyw20735_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cypress:cyw20735:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-06-16 14:15

Updated : 2024-02-28 17:47

NVD link : CVE-2019-18614

Mitre link : CVE-2019-18614

CVE.ORG link : CVE-2019-18614

JSON object : View

Products Affected

cypress

cyw20735
cyw20735_firmware

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2019-18614", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-06-16T14:15:10.463", "references": [{"url": "https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_18614.md", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow, an attacker can either send packets over the air or as unprivileged local user. Over the air, the minimal PoC is sending \"l2ping -s 600\" to the target address prior to any pairing. Locally, the buffer overflow is immediately triggered by opening an ACL or SCO connection to a headset. This occurs because, in WICED Studio 6.2 and 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE and BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE are set to 384."}, {"lang": "es", "value": "En la tarjeta de evaluaci\u00f3n de Cypress CYW20735, cualquier dato que exceda los 384 bytes es copiado y causa un desbordamiento. Esto es debido a que el tama\u00f1o m\u00e1ximo del b\u00fafer BLOC para enviar y recibir datos es establecido en 384 bytes, pero todo lo dem\u00e1s todav\u00eda est\u00e1 configurado con el tama\u00f1o habitual de 1092 (que se us\u00f3 para todo en la tarjetas de evaluaci\u00f3n anteriores a CYW20719 y posteriores a CYW20819). Para desencadenar el desbordamiento, un atacante puede enviar paquetes a trav\u00e9s del aire o como un usuario local sin privilegios. A trav\u00e9s del aire, el PoC m\u00ednimo est\u00e1 enviando \"l2ping -s 600\" a la direcci\u00f3n de destino antes de cualquier emparejamiento. Localmente, el desbordamiento del b\u00fafer se desencadena inmediatamente al abrir una conexi\u00f3n ACL o SCO en un auricular. Esto ocurre porque, en WICED Studio versiones 6.2 y 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE y BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE est\u00e1n establecidas en 384"}], "lastModified": "2020-06-24T19:09:19.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cypress:cyw20735_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48560F70-2F4E-4F93-893B-AE316FFF1FAE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cypress:cyw20735:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DD27A338-CA59-4180-8AD8-F2AF6C3081B0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}