{"schemaVersion":3,"id":"CVE-2019-17212","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the 0xFF delimiter byte. Inside each while loop, the check of the value of *packet_data_pptr is not strictly enforced. More specifically, inside a loop, *packet_data_pptr could be increased and then dereferenced without checking. Moreover, there are many other functions in the format of sn_coap_parser_****() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows, depending on how the CoAP packet buffer is allocated.","dates":{"published":"2019-11-05T14:53:22.000Z","modified":"2024-08-05T01:33:17.245Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0306,"percentile":0.87429,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.0306},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0306,"percentile":0.87429}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0306,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0306,"percentile":0.87429}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-129","name":"Improper Validation of Array Index","description":"The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/129.html"},{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"mbed","product":"mbed","name":"mbed","label":"mbed","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"5.13.2","noFixRecorded":false,"fixedIn":null},{"text":"5.14.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.13.2 | 5.14.0","eol":null,"hubHref":"/vendor/mbed/mbed"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L301","label":"github.com/ARMmbed/…","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L660","label":"github.com/ARMmbed/…","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L331","label":"github.com/ARMmbed/…","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L257","label":"github.com/ARMmbed/…","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L310","label":"github.com/ARMmbed/…","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L313","label":"github.com/ARMmbed/…","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://github.com/ARMmbed/mbed-os/issues/11803","label":"github.com/ARMmbed/mbed-os/issues/11803","hostname":"github.com","tags":["X Refsource MISC","Issue Tracking","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-11-05T14:53:22.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T01:33:17.245Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T11:32:14.069Z","stale":false,"partial":false}}