CVE-2024-47249

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47249
Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/apache/mynewt-nimble/commit/f39330866a85fa4de49246e9d21334bc8d14f0a1 Patch
https://lists.apache.org/thread/7ckxw6481dp68ons627pjcb27c75n0mq Vendor Advisory Mailing List
http://www.openwall.com/lists/oss-security/2024/11/26/3 Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*
History

08 Jul 2025, 14:17

Type Values Removed Values Added
First Time Apache nimble
Apache
CPE cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*
References () https://github.com/apache/mynewt-nimble/commit/f39330866a85fa4de49246e9d21334bc8d14f0a1 - () https://github.com/apache/mynewt-nimble/commit/f39330866a85fa4de49246e9d21334bc8d14f0a1 - Patch
References () https://lists.apache.org/thread/7ckxw6481dp68ons627pjcb27c75n0mq - () https://lists.apache.org/thread/7ckxw6481dp68ons627pjcb27c75n0mq - Vendor Advisory, Mailing List
References () http://www.openwall.com/lists/oss-security/2024/11/26/3 - () http://www.openwall.com/lists/oss-security/2024/11/26/3 - Mailing List, Vendor Advisory

06 Dec 2024, 11:15

Type Values Removed Values Added
References
  • () https://github.com/apache/mynewt-nimble/commit/f39330866a85fa4de49246e9d21334bc8d14f0a1 -

26 Nov 2024, 17:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/11/26/3 -
Summary
  • (es) Vulnerabilidad de validación incorrecta del índice de matriz en Apache NimBLE. La falta de validación de entrada para eventos HCI del controlador podría provocar una corrupción de la memoria fuera de los límites y un bloqueo. Este problema requiere un controlador Bluetooth dañado o falso y, por lo tanto, se considera de baja gravedad. Este problema afecta a Apache NimBLE: hasta la versión 1.7.0. Se recomienda a los usuarios que actualicen a la versión 1.8.0, que soluciona el problema.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.0

26 Nov 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-26 12:15

Updated : 2025-07-08 14:17

NVD link : CVE-2024-47249

Mitre link : CVE-2024-47249

CVE.ORG link : CVE-2024-47249

JSON object : View

Products Affected

apache

  • nimble
CWE
CWE-129

Improper Validation of Array Index