High severity · published Jun 18, 2020
CVE-2020-12885
An infinite loop was discovered in the CoAP library in Arm Mbed OS 5.15.3
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
An infinite loop was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse_multiple_options() parses CoAP options in a while loop. This loop's exit condition is computed using the previously allocated heap memory required for storing the result of parsing multiple options. If the input heap memory calculation results in zero bytes, the loop exit condition is never met and the loop is not terminated. As a result, the packet parsing function never exits, leading to resource consumption.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mbed OS · Arm
5.15.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12885
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12885
Third Party Advisory
https://github.com/ARMmbed/mbed-coap/pull/116
Third Party Advisory
https://github.com/ARMmbed/mbed-os/issues/12929
More from Mbed OS
9.8
CVE-2024-48984
An issue was discovered in MBed OS 6.16.0
9.1
CVE-2020-12886
A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3
9.1
CVE-2020-12884
A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3
9.1
CVE-2020-12883
Buffer over-reads were discovered in the CoAP library in Arm Mbed OS 5.15.3
7.5
CVE-2019-17210
A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02
