garmin forerunner_235_firmware 对数组索引的验证不恰当

CVE编号

CVE-2020-27485

利用情况

暂无

补丁情况

N/A

披露时间

2020-11-17

漏洞描述

Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check the index provided when accessing the local variable in the LGETV and LPUTV instructions. This provides the ability to both read and write memory outside the bounds of the TVM context allocation. It can be leveraged to construct a use-after-free scenario, leading to a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0005.md

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	系统	garmin	forerunner_235_firmware	*	From (including) 7.90	Up to (excluding) 8.20
	运行在以下环境
	硬件	garmin	forerunner_235	-	-

CVSS3评分 9.9

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 低
• 影响范围 已更改
• 用户交互 无
• 可用性 高
• 保密性 高
• 完整性 高

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-ID 漏洞类型 CWE-129 对数组索引的验证不恰当