CVE-2019-16336 Denial of service in n/a
Attackers in radio range can crash Cypress PSoC 4 BLE devices by sending crafted frames with oversized payloads, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-16336?
CVE-2019-16336 is a medium-severity denial of service vulnerability in n/a, published on 12 Feb 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length larger than the configured link layer maximum RX payload size, which allows attackers (in radio range) to cause a denial of service (crash) via a crafted BLE Link Layer frame.
Weakness: CWE-120
Which versions are affected by CVE-2019-16336?
It affects 2 products.
Products include Cypress Cybl11573, Cypress Cyble-416045.
How do I fix CVE-2019-16336?
No fix has been published for CVE-2019-16336 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-16336 being exploited?
There is no known exploitation of CVE-2019-16336 in the wild and no public exploit code.
Sources
Also known as GHSA-p76r-g8wg-qg8m.