CVE-2024-1638: zephyrproject-rtos zephyr Improper Input Validation

Vulnerability summary

CVE-2024-1638 is a critical (CVSS 9.1) Improper Input Validation vulnerability in zephyrproject-rtos zephyr. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-02-2024
   PublishedVulnerability first disclosed.
2. 24-04-2025
   Last modifiedVulnerability information updated.

Description

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.