sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-47250 Apache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound access

Medium 5.0 Published Updated

Out-of-bounds read in Apache NimBLE HCI parsing allows potential memory access issues when processing bogus Bluetooth events.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Local or same network only
Victim action needed
Not needed
Fix
None listed

What is CVE-2024-47250?

CVE-2024-47250 is a medium-severity memory corruption vulnerability in Apache NimBLE, published on 26 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Out-of-bounds Read vulnerability in Apache NimBLE.

Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI event and thus bogus GAP 'device found' events being sent. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Weakness: CWE-125

Which versions are affected by CVE-2024-47250?

It affects 1 product.

Products include Apache Nimble.

How do I fix CVE-2024-47250?

No fix has been published for CVE-2024-47250 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-47250 being exploited?

There is no known exploitation of CVE-2024-47250 in the wild and no public exploit code.

Sources

Also known as GHSA-4qc3-fmcj-w66w.

Is CVE-2024-47250 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free