CVE-2024-48983

Vulnerability

In MBed OS version 6.16.0, the Cordio BLE stack's HCI packet processing code, specifically in wsf_msg.c, contains an integer overflow vulnerability. When processing HCI packets, the software reads a 2-byte length field from the packet header to dynamically determine the payload size. It then allocates a buffer for the entire packet by adding this payload length to the header size, and WsfMsgAlloc additionally increments by sizeof(wsfMsg_t). The arithmetic can overflow a 16-bit or 32-bit integer, causing a significantly smaller buffer than needed. This occurs in the function referenced in [1]. The vulnerability affects the connectivity/FEATURE_BLE/libraries/cordio_stack/wsf/sources/port/baremetal/wsf_msg.c file.

Exploitation

An attacker with the ability to send crafted HCI packets over Bluetooth to a device running the vulnerable MBed OS can exploit this bug. No authentication is required; the attacker only needs to be within Bluetooth range and able to send a sequence of malicious HCI packets. The integer overflow causes the allocation to succeed with a small buffer, after which the incoming packet data overflows this undersized buffer by up to 65 KB. The exploitation sequence is trivial: send an HCI packet with a crafted length field that triggers the integer overflow, leading to a heap buffer overflow.

Impact

Successful exploitation results in a heap buffer overflow of up to 65 KB. The primary impact is denial-of-service (DoS) due to memory corruption. The description notes that the exploitable buffer is dynamically allocated, making further exploitation (such as remote code execution) unlikely, but not theoretically impossible. The CVE describes the impact as trivial to exploit for a DoS.

Mitigation

A fix has been implemented in pull request #388 on the mbed-ce/mbed-os repository, titled "Cordio BLE: Fix integer overflows (CVE-2024-48983)" [2]. The fix addresses the integer overflow by adding proper overflow checks before allocation. Users should update to the latest patched version (after November 19, 2024). No workaround is documented. There is no indication that this CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.