CVE-2024-6443: zephyr: out-of-bound read in utf8_trunc
Published Oct 4, 2024
·Updated
In utf8trunc in zephyr/lib/utils/utf8.c, lastbytep can point to one byte before the string pointer if the string is empty.
Affected Software
1 affected component
zephyrproject zephyr<=3.6.0
Event History
Oct 4, 2024
CVE Published
via MITRE·05:56 AM
Data Sourced
via MITRE·05:56 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-6443?
CVE-2024-6443 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2024-6443?
To fix CVE-2024-6443, update Zephyr Project software to version 3.6.1 or later.
3
What type of vulnerability is CVE-2024-6443?
CVE-2024-6443 is a memory access vulnerability due to improper pointer handling in UTF-8 processing.
4
Is CVE-2024-6443 present in all versions of Zephyr?
CVE-2024-6443 affects all versions of Zephyr up to and including 3.6.0.
5
What are the potential impacts of CVE-2024-6443?
CVE-2024-6443 can lead to unexpected behavior or crashes in applications utilizing vulnerable versions of Zephyr.