CVE-2020-12887 : Vulnerability Insights and Analysis

Memory leaks were discovered in the CoAP library in Arm Mbed OS 5.15.3 when using the Arm mbed-coap library 5.1.5 due to a vulnerability in the CoAP parser.

Understanding CVE-2020-12887

This CVE involves memory leaks in the CoAP library in Arm Mbed OS 5.15.3 when utilizing the Arm mbed-coap library 5.1.5.

What is CVE-2020-12887?

The vulnerability arises from a flaw in the CoAP parser that mishandles memory allocation, potentially leading to memory leaks.

The Impact of CVE-2020-12887

The vulnerability could be exploited to cause memory leaks by crafting malicious packets, resulting in memory not being freed and potential system instability.

Technical Details of CVE-2020-12887

Vulnerability Description

The CoAP parser in Arm Mbed OS 5.15.3 lacks overflow detection, allowing crafted packets to cause memory leaks.
Certain options like COAP_OPTION_URI_QUERY may lead to multiple memory allocations to a single pointer.

Affected Systems and Versions

Arm Mbed OS 5.15.3
Arm mbed-coap library 5.1.5

Exploitation Mechanism

Crafted packets can exploit the lack of overflow detection to cause memory leaks.

Mitigation and Prevention

Immediate Steps to Take

Apply patches provided by the vendor.
Monitor system memory usage for unexpected increases.

Long-Term Security Practices

Regularly update software and libraries to patched versions.
Implement secure coding practices to prevent memory leaks.

Patching and Updates

Ensure all affected systems are updated with the latest patches from Arm Mbed OS and mbed-coap library.