CVE-2019-17211: Integer Overflow
An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sncoapbuildercalcneededpacketdatasize2() is used to calculate the required memory for the CoAP message from the sncoaphdrs data structure. Both returnedbytecount and srccoapmsgptr->payloadlen are of type uint16t. When added together, the result returnedbytecount can wrap around the maximum uint16t value. As a result, insufficient buffer space is allocated for the corresponding CoAP message.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17211?
CVE-2019-17211 is classified as a medium severity vulnerability due to the potential for integer overflow leading to memory corruption.
How do I fix CVE-2019-17211?
To fix CVE-2019-17211, update your Mbed OS to version 5.14.1 or later where the vulnerability is addressed.
Which versions of Mbed OS are affected by CVE-2019-17211?
CVE-2019-17211 affects Mbed OS versions 5.13.2 and 5.14.0.
What are the implications of exploiting CVE-2019-17211?
Exploitation of CVE-2019-17211 may result in unexpected behavior, including potential denial of service due to memory corruption.
How can I determine if my system is vulnerable to CVE-2019-17211?
To determine if your system is vulnerable to CVE-2019-17211, check if you are using Mbed OS version 5.13.2 or 5.14.0.