CVE-2019-17211

Vulnerability

An integer overflow vulnerability exists in the CoAP library of Arm Mbed OS 5.14.0 in the function sn_coap_builder_calc_needed_packet_data_size_2(). The function calculates the required memory for a CoAP message by adding returned_byte_count and src_coap_msg_ptr->payload_len, both of type uint16_t. When the sum exceeds 65535, an integer wrap occurs, resulting in an underestimated buffer size [1].

Exploitation

An attacker can send a crafted CoAP message with a payload length engineered to trigger the integer overflow. The CoAP builder then allocates an insufficient buffer. When the message is subsequently copied into this undersized buffer, as in functions like sn_coap_builder_options_build_add_one_option, a heap out-of-bounds write occurs [1]. No authentication is required; the attack can be performed over the network by any client delivering a malicious CoAP request.

Impact

Successful exploitation leads to a heap buffer overflow, potentially causing memory corruption, denial of service, or arbitrary code execution within the context of the Mbed OS CoAP stack [1]. The exact impact depends on the surrounding memory layout and system hardening.

Mitigation

As of the publication date (2019-11-05), no official patched version of Mbed OS has been announced. Users are advised to apply upstream fixes once available or consider workarounds such as validating CoAP message sizes before processing [1]. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.