CVE-2024-56319: High severity Matter Matter vulnerability

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates the issue is remotely exploitable with low attack complexity, requires no privileges, and requires no user interaction. Exploitation consists of repeatedly appending user labels through the UserLabel cluster until resources are exhausted.

Q: Which deployments are exposed?

Matter/connectedhomeip (Project CHIP) deployments through version 1.4.0.0 are affected before commit e3277eb. The supplied data does not identify any configuration prerequisite beyond the presence of the vulnerable UserLabel cluster behavior.

Q: What is the impact of successful exploitation?

Successful exploitation can cause a denial of service through resource exhaustion. The CVSS vector assigns impact only to availability; it does not indicate confidentiality or integrity impact.

Q: How can this be remediated?

Update to a version containing commit e3277eb02ed8115de5887e8beca0e35007ba71f3 or later. This change addresses unlimited user-label appends in the UserLabel cluster.

Published Dec 18, 2024

Updated

In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can lead to a denial of service (resource exhaustion).

Affected Software

1 affected component

Matter Matter<1.4.0.0

Event History

Dec 18, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates the issue is remotely exploitable with low attack complexity, requires no privileges, and requires no user interaction. Exploitation consists of repeatedly appending user labels through the UserLabel cluster until resources are exhausted.

Which deployments are exposed?

Matter/connectedhomeip (Project CHIP) deployments through version 1.4.0.0 are affected before commit e3277eb. The supplied data does not identify any configuration prerequisite beyond the presence of the vulnerable UserLabel cluster behavior.

What is the impact of successful exploitation?

Successful exploitation can cause a denial of service through resource exhaustion. The CVSS vector assigns impact only to availability; it does not indicate confidentiality or integrity impact.

How can this be remediated?

Update to a version containing commit e3277eb02ed8115de5887e8beca0e35007ba71f3 or later. This change addresses unlimited user-label appends in the UserLabel cluster.

CVE-2024-56319: High severity Matter Matter vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are exposed?

What is the impact of successful exploitation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are exposed?

What is the impact of successful exploitation?

How can this be remediated?