Matter SDK Reachable Assertion Vulnerability in Level Control Cluster

A reachable assertion vulnerability in the Matter SDK (connectedhomeip) has been identified, affecting versions prior to 1.4.2. The issue arises within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is issued and immediately followed by a write of OperationMode=2 in the Pump Configuration and Control cluster, the server tick function violates the assertion 'currentLevel < maxLevel', leading to a crash. This vulnerability can be exploited remotely without authentication, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by crashing the application.

Reproduction

The vulnerability can be reproduced using the chip-tool command-line utility. First, send a MoveToLevel command to increase the CurrentLevel while the device is On. Then, immediately write the OperationMode attribute with a value of 2, which forces the CurrentLevel to the maximum. This sequence violates the assertion in the Level Control cluster, causing the application to crash.

Remediation

Users can update to Matter SDK version 1.4.2 or later to address this vulnerability.