CVE-2024-27099 Azure IoT Platform Device SDK Double Free Vulnerability

2024-02-2718:58:26

CWE-415

GitHub_M

github.com

azure iot platform

uamqp

double free

vulnerability

rce

update submodule

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect AMQP_VALUE failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:microsoft:azure_uamqp:*:*:*:*:*:*:*:*"
    ],
    "vendor": "microsoft",
    "product": "azure_uamqp",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2023-2-08",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]