Out-of-bounds Read in Apache Nimble
CVE-2024-47250
Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI event and thus bogus GAP 'device found' events being sent. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.007 (51.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 51.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: +0.000
Affected products
- Apache Nimble
- Apache Software Foundation Nimble — versions 0
Weakness classification (CWE)
References
- lists.apache.org/thread/zdb50spojlqbn0yxd866mbzqjt2vpt85 (vendor-advisory, Mailing List, Vendor Advisory)
- github.com/apache/mynewt-nimble/commit/3b7a32ea09a3bffaab831ee0ab193a2375fc4df6 (Patch, patch)
- github.com/apache/mynewt-nimble/commit/23d61150ddae4bc8356356d7ef09d816fb89da45 (Patch, patch)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-47250?
- CVE-2024-47250 is a medium-severity vulnerability in Apache Nimble, classified under Out-of-bounds Read. CVSS score: 5.0/10. Published 2024-11-26.
- How severe is CVE-2024-47250?
- Medium severity. CVSS v3 base score is 5.0 out of 10.