CyberRota Analysis
AI-GeneratedThe Apache NimBLE BASS service is vulnerable to an out-of-bounds write and integer underflow, which can lead to stack buffer overflow or arbitrary out-of-bound reads due to improper validation during the parsing of specific PDU operations. This vulnerability can be exploited by nearby devices over Bluetooth, requiring prior pairing that may involve user interaction depending on device settings. Organizations using affected versions up to 1.9.0 should prioritize upgrading to version 1.10.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)