漏洞标题
N/A
漏洞描述信息
在Cypress CYW20735评估板中，任何超过384字节的数据都会被复制并引发溢出。这是因为发送和接收数据的最大BLOC缓冲区大小被设置为384字节，但其他配置仍然设置为1092(在之前的CYW20719和后来的CYW20819评估板中用于所有配置)。要触发溢出，攻击者可以选择通过网络发送 packets 或作为无特权本地用户发送。在网络安全实验室6.2和6.4中，最小PoC在开始任何配对之前向目标地址发送 "l2ping -s 600"。在本地，缓冲区溢出立即触发，因为在此版本中，在WICED Studio 6.2和6.4中，BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE和BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE被设置为384。
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow, an attacker can either send packets over the air or as unprivileged local user. Over the air, the minimal PoC is sending "l2ping -s 600" to the target address prior to any pairing. Locally, the buffer overflow is immediately triggered by opening an ACL or SCO connection to a headset. This occurs because, in WICED Studio 6.2 and 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE and BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE are set to 384.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Cypress Semiconductor CYW20735 缓冲区错误漏洞
漏洞描述信息
Cypress Semiconductor CYW20735是美国赛普拉斯半导体（Cypress Semiconductor）公司的一款单芯片蓝牙收发器。 Cypress CYW20735中存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。
CVSS信息
N/A
漏洞类别
缓冲区错误