漏洞标题
N/A
漏洞描述信息
在Arm Mbed OS 5.15.3中的CoAP库中发现了一个缓冲区超读。CoAP解析器负责解析接收的CoAP包。 sn_coap_parser_options_parse_multiple_options()函数解析可能在同一包中连续多次发生的CoAP选项。在处理选项时，未进行先越界内存检查的 packet_data_pptr 被访问。temp_parsed_uri_query_ptr 验证为正确的范围，但 temp_parsed_uri_query_ptr valid 的范围是根据分配的堆内存数量来确定的，而不是实际输入大小。因此，temp_parsed_uri_query_ptr 的检查可能不足以安全访问 packet_data_pptr指向的区域。因此，访问了包缓冲区预期边界之外的内存区域。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse_multiple_options() parses CoAP options that may occur multiple consecutive times in a single packet. While processing the options, packet_data_pptr is accessed after being incremented by option_len without a prior out-of-bounds memory check. The temp_parsed_uri_query_ptr is validated for a correct range, but the range valid for temp_parsed_uri_query_ptr is derived from the amount of allocated heap memory, not the actual input size. Therefore the check of temp_parsed_uri_query_ptr may be insufficient for safe access to the area pointed to by packet_data_pptr. As a result, access to a memory area outside of the intended boundary of the packet buffer is made.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
ARM Mbed OS CoAP library 缓冲区错误漏洞
漏洞描述信息
ARM Mbed OS是英国ARM公司的一套专用于物联网的开源嵌入式操作系统。CoAP library是其中的一个约束应用协议（CoAP）库。 ARM Mbed OS 5.15.3版本中的CoAP library存在缓冲区错误漏洞。攻击者可利用该漏洞消耗所有可用资源，造成拒绝服务。
CVSS信息
N/A
漏洞类别
缓冲区错误