CVE-2024-42484

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42484", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-08-02T14:13:04.617Z", "datePublished": "2024-09-12T14:12:13.174Z", "dateUpdated": "2024-09-12T16:53:05.559Z"}, "containers": {"cna": {"title": "ESP-NOW OOB Vulnerability In Group Type Message", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/espressif/esp-now/security/advisories/GHSA-q6f6-4qc5-vhx5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/espressif/esp-now/security/advisories/GHSA-q6f6-4qc5-vhx5"}, {"name": "https://github.com/espressif/esp-now/commit/b03a1b4593713fa4bf0038a87edca01f10114a7a", "tags": ["x_refsource_MISC"], "url": "https://github.com/espressif/esp-now/commit/b03a1b4593713fa4bf0038a87edca01f10114a7a"}], "affected": [{"vendor": "espressif", "product": "esp-now", "versions": [{"version": "< 2.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-12T14:12:13.174Z"}, "descriptions": [{"lang": "en", "value": "ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound (OOB) vulnerability was discovered in the implementation of the ESP-NOW group type message because there is no check for the addrs_num field of the group type message. This can result in memory corruption related attacks. Normally there are two fields in the group information that need to be checked, i.e., the addrs_num field and the addrs_list fileld. Since we only checked the addrs_list field, an attacker can send a group type message with an invalid addrs_num field, which will cause the message handled by the firmware to be much larger than the current buffer, thus causing a memory corruption issue that goes beyond the payload length."}], "source": {"advisory": "GHSA-q6f6-4qc5-vhx5", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "espressif", "product": "esp-now", "cpes": ["cpe:2.3:a:espressif:esp-now:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.5.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-12T16:46:44.456080Z", "id": "CVE-2024-42484", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T16:53:05.559Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42484", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-12T16:46:44.456080Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:espressif:esp-now:*:*:*:*:*:*:*:*"], "vendor": "espressif", "product": "esp-now", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T16:52:59.985Z"}}], "cna": {"title": "ESP-NOW OOB Vulnerability In Group Type Message", "source": {"advisory": "GHSA-q6f6-4qc5-vhx5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "espressif", "product": "esp-now", "versions": [{"status": "affected", "version": "< 2.5.2"}]}], "references": [{"url": "https://github.com/espressif/esp-now/security/advisories/GHSA-q6f6-4qc5-vhx5", "name": "https://github.com/espressif/esp-now/security/advisories/GHSA-q6f6-4qc5-vhx5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/espressif/esp-now/commit/b03a1b4593713fa4bf0038a87edca01f10114a7a", "name": "https://github.com/espressif/esp-now/commit/b03a1b4593713fa4bf0038a87edca01f10114a7a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound (OOB) vulnerability was discovered in the implementation of the ESP-NOW group type message because there is no check for the addrs_num field of the group type message. This can result in memory corruption related attacks. Normally there are two fields in the group information that need to be checked, i.e., the addrs_num field and the addrs_list fileld. Since we only checked the addrs_list field, an attacker can send a group type message with an invalid addrs_num field, which will cause the message handled by the firmware to be much larger than the current buffer, thus causing a memory corruption issue that goes beyond the payload length."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-12T14:12:13.174Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42484", "state": "PUBLISHED", "dateUpdated": "2024-09-12T16:53:05.559Z", "dateReserved": "2024-08-02T14:13:04.617Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-09-12T14:12:13.174Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "esp-now", "vendor": "espressif", "versions": [{"status": "affected", "version": "< 2.5.2"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:espressif:esp-now:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "esp-now", "vendor": "espressif", "versions": [{"lessThan": "2.5.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound (OOB) vulnerability was discovered in the implementation of the ESP-NOW group type message because there is no check for the addrs_num field of the group type message. This can result in memory corruption related attacks. Normally there are two fields in the group information that need to be checked, i.e., the addrs_num field and the addrs_list fileld. Since we only checked the addrs_list field, an attacker can send a group type message with an invalid addrs_num field, which will cause the message handled by the firmware to be much larger than the current buffer, thus causing a memory corruption issue that goes beyond the payload length."}, {"lang": "es", "value": "El componente ESP-NOW proporciona un protocolo de comunicaci\u00f3n Wi-Fi sin conexi\u00f3n. Se descubri\u00f3 una vulnerabilidad Out-of-Bound (OOB) en la implementaci\u00f3n del mensaje de tipo de grupo ESP-NOW porque no hay una verificaci\u00f3n para el campo addrs_num del mensaje de tipo de grupo. Esto puede resultar en ataques relacionados con corrupci\u00f3n de memoria. Normalmente hay dos campos en la informaci\u00f3n del grupo que necesitan ser verificados, es decir, el campo addrs_num y el campo addrs_list. Dado que solo verificamos el campo addrs_list, un atacante puede enviar un mensaje de tipo de grupo con un campo addrs_num no v\u00e1lido, lo que har\u00e1 que el mensaje manejado por el firmware sea mucho m\u00e1s grande que el b\u00fafer actual, causando as\u00ed un problema de corrupci\u00f3n de memoria que va m\u00e1s all\u00e1 de la longitud del payload."}], "id": "CVE-2024-42484", "lastModified": "2026-06-17T07:49:32.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42484", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-12T16:46:44.456080Z", "version": "2.0.3"}}]}, "published": "2024-09-12T15:18:22.320", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/espressif/esp-now/commit/b03a1b4593713fa4bf0038a87edca01f10114a7a"}, {"source": "security-advisories@github.com", "url": "https://github.com/espressif/esp-now/security/advisories/GHSA-q6f6-4qc5-vhx5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}