CVE-2020-12887

Vulnerability

A memory leak vulnerability exists in the CoAP library used by Arm Mbed OS 5.15.3 and the Arm mbed-coap library 5.1.5. In sn_coap_parser_options_parse(), when parsing option number fields from received CoAP packets, the option number is computed as the sum of the previous option number and a delta, both stored as unsigned 16-bit integers. No overflow detection is implemented, so a crafted packet can cause the option number to wrap around and process the same option number multiple times. For options COAP_OPTION_URI_QUERY, COAP_OPTION_URI_PATH, COAP_OPTION_LOCATION_QUERY, and COAP_OPTION_ETAG, memory is allocated without checking if it has already been allocated. Combining the integer overflow with the lack of allocation checks leads to multiple allocations being assigned to the same pointer, orphaning allocated buffers [1][3].

Exploitation

To exploit this vulnerability, an attacker needs network access to send a specially crafted CoAP message to a device running the vulnerable library. No authentication is required, as the CoAP services typically listen for incoming packets. By carefully constructing the packet with option number fields that cause integer wraparound, the attacker triggers the parser to allocate memory multiple times for options that should only appear once. The sequence of parsing a packet with overlapping option numbers results in multiple malloc calls for the same option pointer, while only the last allocation is stored, causing previous allocations to become unreferenced [1].

Impact

Successful exploitation results in memory leaks, as the orphaned buffers are never freed. This gradually depletes available heap memory, potentially leading to denial of service (DoS) by exhausting device memory. The leak can be as small as 8 bytes per packet but can be repeated to accumulate over time. The confidentiality, integrity, and availability of the device may be affected if memory exhaustion prevents normal operation [1][3].

Mitigation

A fix was implemented by adding a helper function sn_coap_parser_add_u16_limit() that detects 16-bit overflow when adding option deltas, causing the parser to reject crafted packets that would trigger the wrap. Additionally, checks were added in sn_coap_parser_options_parse_multiple_options() to prevent overwriting already-allocated pointers. The fix is included in a commit to the mbed-coap repository [2] and was merged via pull request #116 [4]. Users should update to version of mbed-coap after the commit 4647a68 or to a patched release of Mbed OS (e.g., 5.15.4 or later). No workarounds are available for unpatched versions; blocking untrusted CoAP traffic at the network level can mitigate exploitation but is not a complete solution [1][4].