CVE-2020-12883

{"id": "CVE-2020-12883", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2020-06-18T19:15:09.893", "references": [{"url": "https://github.com/ARMmbed/mbed-coap/pull/116", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/ARMmbed/mbed-os/issues/12925", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/ARMmbed/mbed-os/issues/12926", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/ARMmbed/mbed-os/issues/12927", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/ARMmbed/mbed-coap/pull/116", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ARMmbed/mbed-os/issues/12925", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ARMmbed/mbed-os/issues/12926", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ARMmbed/mbed-os/issues/12927", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Buffer over-reads were discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the option delta and option length bytes. The actual input packet length is not verified against the number of bytes read when processing the option extended delta and the option extended length. Moreover, the calculation of the message_left variable, in the case of non-extended option deltas, is incorrect and indicates more data left for processing than provided in the function input. All of these lead to heap-based or stack-based memory location read access that is outside of the intended boundary of the buffer. Depending on the platform-specific memory management mechanisms, it can lead to processing of unintended inputs or system memory access violation errors."}, {"lang": "es", "value": "Se detectaron lecturas excesivas del b\u00fafer en la biblioteca CoAP en Arm Mbed OS versi\u00f3n 5.15.3. El analizador CoAP es responsable de analizar los paquetes CoAP recibidos. La funci\u00f3n sn_coap_parser_options_parse() analiza la entrada CoAP linealmente usando un bucle while. Una vez que se analiza una opci\u00f3n en un bucle, el punto actual (*packet_data_pptr) se incrementa correspondientemente. El puntero es restringido por el tama\u00f1o del b\u00fafer recibido, as\u00ed como por los bytes option delta y option length. La longitud real del paquete de entrada no es comprobada con el n\u00famero de bytes le\u00eddos cuando se procesa la opci\u00f3n delta extendida y la opci\u00f3n longitud extendida. Adem\u00e1s, el c\u00e1lculo de la variable message_left, en el caso de deltas de opci\u00f3n no extendida, es incorrecto e indica que quedan m\u00e1s datos para procesar que los proporcionados en la entrada de la funci\u00f3n. Todo esto conlleva a un acceso de lectura de ubicaci\u00f3n de memoria en la regi\u00f3n heap o stack que est\u00e1 fuera del l\u00edmite previsto del b\u00fafer. Dependiendo de los mecanismos de administraci\u00f3n de memoria espec\u00edficos de la plataforma, puede conllevar al procesamiento de entradas no deseadas o errores de violaci\u00f3n de acceso de la memoria de sistema"}], "lastModified": "2024-11-21T05:00:29.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arm:mbed_os:5.15.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B314FCEF-12B7-4510-AC5E-12D3574E3E68"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}