Matter SDK Reachable Assertion Vulnerability in Command Processing Logic

A reachable assertion vulnerability has been identified in the Matter SDK (connectedhomeip) versions prior to 1.4.0. The issue arises in the interaction model command processing logic, where an InvokeCommandRequest sent to a nonexistent endpoint and cluster is incorrectly validated. This flaw, due to missing checks, leads to a VerifyOrDie failure in ProcessCommandDataIB, causing a crash (SIGABRT). The vulnerability has been acknowledged and fixed in a later revision (PR #37207).

Impact

Exploitation of this vulnerability causes a crash due to a failed assertion, disrupting the application's normal operation.

Reproduction

The vulnerability can be reproduced by sending an InvokeCommandRequest to a nonexistent endpoint (0x34) and cluster (0x34). The all-cluster-app application will incorrectly respond with a success status instead of an 'Endpoint Not Found' error. This issue can be replicated using the chip-tool command-line tool.

Remediation

Users can update to Matter SDK version 1.4.2.0 or later, where this vulnerability has been fixed.