CVE-2024-47249: Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler
Improper Validation of Array Index vulnerability in Apache NimBLE.
Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0.
Users are recommended to upgrade to version 1.8.0, which fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47249?
The severity of CVE-2024-47249 is considered low due to the requirement of a broken or bogus Bluetooth controller.
How do I fix CVE-2024-47249?
To fix CVE-2024-47249, upgrade to Apache NimBLE version 1.7.1 or later, where input validation issues have been addressed.
What causes the vulnerability CVE-2024-47249?
CVE-2024-47249 is caused by improper validation of array index leading to potential out-of-bound memory corruption.
Which software is affected by CVE-2024-47249?
CVE-2024-47249 affects Apache NimBLE versions up to 1.7.0.
What type of vulnerability is CVE-2024-47249?
CVE-2024-47249 is classified as an improper validation of array index vulnerability.