CVE-2024-48985

An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet data. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier and the header length. If the allocate fails because the specified packet is too large, no exception handling occurs and hciTrSerialRxIncoming continues to write bytes into the 4-byte large temporary header buffer, leading to a buffer overflow. This can be leveraged into an arbitrary write by an attacker. It is possible to overwrite the pointer to the buffer that is supposed to receive the contents of the packet body but which couldn't be allocated. One can then overwrite the state variable used by the function to determine which step of the parsing process is currently being executed. This advances the function to the next state, where it proceeds to copy data to that arbitrary location. The packet body is then written wherever the corrupted data pointer is pointing.

• CWE-120
• CWE-120

• https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/source/cordio/stack_adaptation/hci_tr.c#L200Product
• https://github.com/mbed-ce/mbed-os/pull/384Issue Tracking, Vendor Advisory

Published

Nov 20, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-48974The ventilator does not perform proper file integrity checks…9.3
• CVE-2024-4898The InstaWP Connect – 1-click WP Staging & Migration plugin …9.8
• CVE-2024-48981An issue was discovered in MBed OS 6.16.0. During processing…7.5
• CVE-2024-48982An issue was discovered in MBed OS 6.16.0. Its hci parsing s…7.5
• CVE-2024-48983An issue was discovered in MBed OS 6.16.0. During processing…7.5
• CVE-2024-48984An issue was discovered in MBed OS 6.16.0. When parsing hci …9.8
• CVE-2024-48986An issue was discovered in MBed OS 6.16.0. Its hci parsing s…7.5
• CVE-2024-48987Snipe-IT before 7.0.10 allows remote code execution (associa…6.6
• CVE-2024-48988SQL Injection vulnerability in Apache StreamPark. This issu…7.6
• CVE-2024-48989A vulnerability in the PROFINET stack implementation of the …7.5
• CVE-2024-4899The SEOPress WordPress plugin before 7.8 does not sanitise …5
• CVE-2024-48990Qualys discovered that needrestart, before version 3.8, allo…7.8