Azure IoT Platform Device SDK Remote Code Execution Vulnerability
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 7.2%
exploitation probability
7.2%top 6% of all CVEs
observed exploitation
nono source reports it
In short
A memory allocation failure in the Azure IoT Platform Device SDK can cause a use-after-free vulnerability, allowing attackers to execute arbitrary code on affected devices during connection communication.
Technical detail
CWE-94 (Improper Control of Generation of Code) manifests as a use-after-free in the open_get_offered_capabilities function when memory allocation fails during AMQP 1.0 connection negotiation. Remote attackers can trigger this condition without authentication to achieve code execution on the affected client device. Mitigation requires updating to commit 30865c9c or later.
Summary generated and translated by AI from the official description.
The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Azure · azure-uamqp-c