Sign-up

ID

VAR-202206-2160


CVE

CVE-2022-24893


TITLE

Espressif Systems  of  ESP-IDF  Out-of-bounds write vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-012675

DESCRIPTION

ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be triggered during provisioning, because there is no check for the `SegN` field of the Transaction Start PDU. This can result in memory corruption related attacks and potentially attacker gaining control of the entire system. Patch commits are available on the 4.1, 4.2, 4.3 and 4.4 branches and users are recommended to upgrade. The upgrade is applicable for all applications and users of `ESP-BLE-MESH` component from `ESP-IDF`. As it is implemented in the Bluetooth Mesh stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware. Espressif Systems of ESP-IDF Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 2.25

sources: NVD: CVE-2022-24893 // JVNDB: JVNDB-2022-012675 // CNNVD: CNNVD-202206-2541 // VULMON: CVE-2022-24893

IOT TAXONOMY

category:['network device']sub_category:bluetooth device

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:espressifmodel:esp-idfscope:eqversion:4.2.3

Trust: 1.8

vendor:espressifmodel:esp-idfscope:eqversion:4.4.1

Trust: 1.8

vendor:espressifmodel:esp-idfscope:eqversion:4.3.2

Trust: 1.8

vendor:espressifmodel:esp-idfscope:eqversion:4.1.3

Trust: 1.8

vendor:espressifmodel:esp-idfscope: - version: -

Trust: 0.8

vendor:espressifmodel:esp-idfscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-012675 // NVD: CVE-2022-24893

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-24893
value: HIGH

Trust: 1.0

security-advisories@github.com: CVE-2022-24893
value: HIGH

Trust: 1.0

NVD: CVE-2022-24893
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202206-2541
value: HIGH

Trust: 0.6

VULMON: CVE-2022-24893
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-24893
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2022-24893
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

security-advisories@github.com: CVE-2022-24893
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-24893
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2022-24893 // JVNDB: JVNDB-2022-012675 // CNNVD: CNNVD-202206-2541 // NVD: CVE-2022-24893 // NVD: CVE-2022-24893

PROBLEMTYPE DATA

problemtype:CWE-788

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-012675 // NVD: CVE-2022-24893

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202206-2541

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202206-2541

PATCH

title:Espressif ESP-IDF Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=199148

Trust: 0.6

sources: CNNVD: CNNVD-202206-2541

EXTERNAL IDS

db:NVDid:CVE-2022-24893

Trust: 3.4

db:JVNDBid:JVNDB-2022-012675

Trust: 0.8

db:CNNVDid:CNNVD-202206-2541

Trust: 0.6

db:OTHERid:NONE

Trust: 0.1

db:VULMONid:CVE-2022-24893

Trust: 0.1

sources: OTHER: None // VULMON: CVE-2022-24893 // JVNDB: JVNDB-2022-012675 // CNNVD: CNNVD-202206-2541 // NVD: CVE-2022-24893

REFERENCES

url:https://github.com/espressif/esp-idf/security/advisories/ghsa-7f7f-jj2q-28wm

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-24893

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-24893/

Trust: 0.6

url:https://ieeexplore.ieee.org/abstract/document/10769424

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/787.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: OTHER: None // VULMON: CVE-2022-24893 // JVNDB: JVNDB-2022-012675 // CNNVD: CNNVD-202206-2541 // NVD: CVE-2022-24893

SOURCES

db:OTHERid: -
db:VULMONid:CVE-2022-24893
db:JVNDBid:JVNDB-2022-012675
db:CNNVDid:CNNVD-202206-2541
db:NVDid:CVE-2022-24893

LAST UPDATE DATE

2025-01-30T22:22:29.828000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2022-24893date:2022-07-08T00:00:00
db:JVNDBid:JVNDB-2022-012675date:2023-08-31T08:32:00
db:CNNVDid:CNNVD-202206-2541date:2022-07-11T00:00:00
db:NVDid:CVE-2022-24893date:2022-07-08T14:17:31.070

SOURCES RELEASE DATE

db:VULMONid:CVE-2022-24893date:2022-06-25T00:00:00
db:JVNDBid:JVNDB-2022-012675date:2023-08-31T00:00:00
db:CNNVDid:CNNVD-202206-2541date:2022-06-25T00:00:00
db:NVDid:CVE-2022-24893date:2022-06-25T07:15:07.147