What is CVE-2024-1638?

CVE-2024-1638 is a high-severity vulnerability in Zephyrproject Zephyr, classified under Improper Input Validation. CVSS score: 8.2/10. Published 2024-02-19.

How severe is CVE-2024-1638?

High severity. CVSS v3 base score is 8.2 out of 10.

Improper input validation in Zephyrproject Zephyr

CVE-2024-1638

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.004 (27.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.

Affected products

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

vulnerabilities@zephyrproject.org (Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2024-1638?: CVE-2024-1638 is a high-severity vulnerability in Zephyrproject Zephyr, classified under Improper Input Validation. CVSS score: 8.2/10. Published 2024-02-19.
How severe is CVE-2024-1638?: High severity. CVSS v3 base score is 8.2 out of 10.