CVE-2019-18614

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow, an attacker can either send packets over the air or as unprivileged local user. Over the air, the minimal PoC is sending "l2ping -s 600" to the target address prior to any pairing. Locally, the buffer overflow is immediately triggered by opening an ACL or SCO connection to a headset. This occurs because, in WICED Studio 6.2 and 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE and BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE are set to 384.

En la tarjeta de evaluación de Cypress CYW20735, cualquier dato que exceda los 384 bytes es copiado y causa un desbordamiento. Esto es debido a que el tamaño máximo del búfer BLOC para enviar y recibir datos es establecido en 384 bytes, pero todo lo demás todavía está configurado con el tamaño habitual de 1092 (que se usó para todo en la tarjetas de evaluación anteriores a CYW20719 y posteriores a CYW20819). Para desencadenar el desbordamiento, un atacante puede enviar paquetes a través del aire o como un usuario local sin privilegios. A través del aire, el PoC mínimo está enviando "l2ping -s 600" a la dirección de destino antes de cualquier emparejamiento. Localmente, el desbordamiento del búfer se desencadena inmediatamente al abrir una conexión ACL o SCO en un auricular. Esto ocurre porque, en WICED Studio versiones 6.2 y 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE y BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE están establecidas en 384

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-10-29 CVE Reserved
2020-06-16 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-787: Out-of-bounds Write

CAPEC

References (1)

URL	Tag	Source
https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_18614.md	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cypress Search vendor "Cypress"	Cyw20735 Firmware Search vendor "Cypress" for product "Cyw20735 Firmware"	-	-	Affected	in	Cypress Search vendor "Cypress"	Cyw20735 Search vendor "Cypress" for product "Cyw20735"	-	-	Safe