SB2022062354 - Out-of-bounds write in ESP-IDF

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2022-24893)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in the ESP-BLE-MESH provisioning message handling logic when processing a crafted Transaction Start PDU during provisioning. A remote attacker can send a specially crafted provisioning PDU with an invalid SegN field to execute arbitrary code.

The issue occurs because the SegN field is not checked, which can cause firmware to handle a message larger than the available global buffer.

Remediation

Install update from vendor's website.

References

• https://github.com/espressif/esp-idf/security/advisories/GHSA-7f7f-jj2q-28wm
• https://github.com/espressif/esp-idf/commit/5a87a9c65e00fd2ffc120c56f32e9f8145e8a11c