Matter SDK Null Pointer Dereference Vulnerability in ReadRevisionAttribute Function

A null pointer dereference vulnerability has been identified in the Matter SDK (connectedhomeip) versions prior to 1.4.0. The issue affects the ReadRevisionAttribute function, which is used in several clusters, including Channel, Account Login, TargetNavigator, ContentLauncher, and MediaPlayback. The vulnerability arises because the function does not properly validate the delegate pointer before dereferencing it, allowing remote unauthenticated attackers to send crafted read requests that cause the device to crash, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a segmentation fault, leading to a crash of the application. This behavior has been confirmed in the All Clusters App using Matter SDK version 1.4 (commit ab3d5ae).

Reproduction

The vulnerability can be reproduced by building the All Clusters App and using the chip-tool to read the revision attribute from a cluster affected by the vulnerability, such as the Channel cluster. The absence of a null pointer check in the ReadRevisionAttribute function will lead to a crash, demonstrating the vulnerability.

Remediation

Users can update to Matter SDK version 1.4.0 or later, where this vulnerability has been addressed.