CVE-2024-48983: Integer Overflow
First published: Wed Nov 20 2024(Updated: )
An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet header. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier plus the header length. WsfMsgAlloc then increments this again by sizeof(wsfMsg_t). This may cause an integer overflow that results in the buffer being significantly too small to contain the entire packet. This may cause a buffer overflow of up to 65 KB . This bug is trivial to exploit for a denial of service but can generally not be exploited further because the exploitable buffer is dynamically allocated.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arm Mbed OS | =6.16.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-48983?
CVE-2024-48983 has been rated as a high severity vulnerability due to potential buffer overflow risks.
How do I fix CVE-2024-48983?
To mitigate CVE-2024-48983, it is recommended to update MBed OS to a patched version addressing the buffer allocation issue.
Which versions of MBed OS are affected by CVE-2024-48983?
CVE-2024-48983 specifically affects MBed OS version 6.16.0.
What type of vulnerability is CVE-2024-48983?
CVE-2024-48983 is identified as a buffer overflow vulnerability that can occur during the processing of HCI packets.
Are there any workarounds for CVE-2024-48983?
Currently, the best practice is to update MBed OS, as there are no known effective workarounds for CVE-2024-48983.
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/event
- agent/severity
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/arm
- canonical/arm mbed os
- version/arm mbed os/6.16.0