CVE-2024-24746 Apache NimBLE: Denial of service in NimBLE Bluetooth stack

2024-04-0611:56:07

CWE-835

apache

github.com

cve-2024-24746

apache nimble

gatt operation

infinite loop

bluetooth stack

upgrade

version 1.7.0

AI Score

6.8

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Loop with Unreachable Exit Condition (‘Infinite Loop’) vulnerability in Apache NimBLE.

Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device.

This issue affects Apache NimBLE: through 1.6.0.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "nimble",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.6.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]