Matter SDK Use of Uninitialized Value Vulnerability Leading to Denial-of-Service

A vulnerability exists in the Matter SDK (connectedhomeip) prior to version 1.4.0, where the 'GetDestinationGroupId().Value()' method is invoked without verifying if a value is present. This oversight causes a crash when an 'InvokeCommand' is sent without initializing the destination group ID. The vulnerability affects all versions before the patch in commit 0360cc3 (Dec 5, 2024) and results in a denial-of-service condition by causing a SIGABRT crash.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to crash unexpectedly.

Reproduction

The vulnerability can be reproduced by sending a groupcast message without initializing the destination group ID. This can be done by building a message that omits the 'packetHeader.GetDestinationGroupId()' initialization. The resulting crash can be analyzed using a debugger, which will reveal the SIGABRT error caused by the uninitialized resource.

Remediation

Users can upgrade to Matter SDK version 1.4.0 or later, where this vulnerability has been fixed.