Cypress WICED Studio 6.2 CYW20735B1/6.2 CYW20819A1 Bluetooth Low Energy dhmulp_getRxBuffer Header out-of-bounds write

Summaryinfo

A vulnerability has been found in Cypress WICED Studio 6.2 CYW20735B1/6.2 CYW20819A1 and classified as critical. Affected by this vulnerability is the function dhmulp_getRxBuffer of the component Bluetooth Low Energy. The manipulation as part of Header leads to out-of-bounds write. This vulnerability is referenced as CVE-2019-13916. The attack needs to be initiated within the local network. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cypress WICED Studio 6.2 CYW20735B1/6.2 CYW20819A1. This issue affects the function dhmulp_getRxBuffer of the component Bluetooth Low Energy. The manipulation as part of a Header leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Cypress (formerly Broadcom) WICED Studio 6.2 CYW20735B1 and CYW20819A1. As a Bluetooth Low Energy (BLE) packet is received, it is copied into a Heap (ThreadX Block) buffer. The buffer allocated in dhmulp_getRxBuffer is four bytes too small to hold the maximum of 255 bytes plus headers. It is possible to corrupt a pointer in the linked list holding the free buffers of the g_mm_BLEDeviceToHostPool Block pool. This pointer can be fully controlled by overflowing with 3 bytes of packet data and the first byte of the packet CRC checksum. The checksum can be freely chosen by adapting the packet data accordingly. An attacker might be able to allocate the overwritten address as a receive buffer resulting in a write-what-where condition. This is fixed in BT SDK2.4 and BT SDK2.45.

The weakness was published 04/13/2020. The identification of this vulnerability is CVE-2019-13916 since 07/18/2019. The attack needs to be done within the local network. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Cypress

Name

• WICED Studio

Version

• 6.2 CYW20735B1
• 6.2 CYW20819A1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion