CVE-2024-48985

Vulnerability

In MBed OS 6.16.0, the HCI packet processing function hciTrSerialRxIncoming in connectivity/FEATURE_BLE/source/cordio/stack_adaptation/hci_tr.c [1] dynamically determines the packet body length by reading 2 bytes from the packet data. A buffer is allocated to hold the entire packet, with size calculated as the header length plus the body length. If the allocation fails because the packet is too large, no exception handling occurs, and the function continues to write incoming bytes into a 4-byte temporary header buffer, causing a buffer overflow.

Exploitation

An attacker must be able to send crafted HCI packets to the device (e.g., via BLE proximity or local access). The attacker sends an oversized HCI packet that triggers a failed memory allocation. The overflow allows overwriting the pointer to the intended packet body buffer (which was not allocated) and the state variable that controls the parsing state machine. This advances the function to the next state, where it copies the packet body to the arbitrary location pointed to by the corrupted pointer.

Impact

Successful exploitation results in an arbitrary write primitive. The attacker can write controlled data to any memory location, potentially leading to code execution, privilege escalation, or denial of service within the BLE stack context.

Mitigation

The vulnerability is fixed in pull request #384 [2], which was merged on November 19, 2024. Users should update to a version of MBed OS that includes this fix (e.g., after commit 54e8693). No workaround is available; devices running MBed OS 6.16.0 are vulnerable until patched.