CVE-2024-48984

Vulnerability

In MBed OS 6.16.0, the function hciEvtProcessLeExtAdvReport in hci_evt.c [1] parses HCI LE Extended Advertising Report events. The parser dynamically determines the number of reports by reading a byte from the input stream. It then iterates through reports, tracking the largest report length to allocate a buffer that fits each individual report. However, it does not validate that the addresses of subsequent report length fields are within the original input buffer. This allows an out-of-bounds read of the length field for the nth report if the previous report's data extends beyond the buffer boundary.

Exploitation

An attacker needs to send a crafted BLE advertising packet to a device running MBed OS 6.16.0 with BLE enabled. The attacker must be within radio range and able to transmit HCI events (e.g., via a malicious BLE peripheral). The parsing logic reads report lengths from memory that may be out-of-bounds. If the allocated buffer for reports happens to overlap with the out-of-bounds location, the length field of the nth report can be overwritten when copying the (n-1)th report. This corrupted length is then used in a memcpy into the new buffer, potentially causing a heap buffer overflow.

Impact

Successful exploitation could lead to heap memory corruption, potentially allowing an attacker to achieve arbitrary code execution or cause a denial of service. The impact is limited by the need for precise heap layout conditions, but the vulnerability is considered serious due to the possibility of remote code execution over BLE.

Mitigation

The issue is fixed in pull request #387 [2], which adds bounds checking to ensure all report length fields are within the input buffer. Users should update to a patched version of MBed OS (the fix was merged on 2024-11-19). No workaround is available; updating is recommended. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of publication.