CVE-2019-18614: Buffer Overflow
First published: Tue Jun 16 2020(Updated: )
On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow, an attacker can either send packets over the air or as unprivileged local user. Over the air, the minimal PoC is sending "l2ping -s 600" to the target address prior to any pairing. Locally, the buffer overflow is immediately triggered by opening an ACL or SCO connection to a headset. This occurs because, in WICED Studio 6.2 and 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE and BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE are set to 384.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cypress Cyw20735 Firmware | ||
| Cypress CYW20735 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2019-18614.
What is the severity rating of CVE-2019-18614?
The severity rating of CVE-2019-18614 is 7.8 (High).
What is the impact of CVE-2019-18614?
CVE-2019-18614 allows an attacker to cause an overflow by sending data that exceeds 384 bytes, potentially leading to arbitrary code execution or a denial of service.
How can I check if I am affected by CVE-2019-18614?
If you are using the Cypress CYW20735 firmware or the Cypress CYW20735 evaluation board, you may be affected by CVE-2019-18614.
Is there a fix available for CVE-2019-18614?
Yes, it is recommended to update to a patched version of the Cypress CYW20735 firmware that addresses the overflow vulnerability.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- agent/source
- vendor/cypress
- canonical/cypress cyw20735 firmware
- canonical/cypress cyw20735