Golioth Firmware SDK Blockwise Transfer Path Out-of-Bounds Read Vulnerability

A vulnerability exists in Golioth Firmware SDK versions 0.19.1 prior to 0.22.0, allowing for an out-of-bounds read. This issue arises from improper null termination of a blockwise transfer path. The function blockwise_transfer_init() accepts a path of length CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and uses strncpy() to copy it, without ensuring a trailing null byte. This leaves the context path unterminated. Subsequently, a strlen() operation on this buffer in golioth_coap_client_get_internal() can read past the allocated memory, leading to a crash and denial-of-service condition. The vulnerability is triggered by application-controlled input, not network input by default.

Impact

Exploitation of this vulnerability causes a crash, leading to a denial-of-service condition.

Remediation

Users can upgrade to Golioth Firmware SDK version 0.22.0 or later to address this vulnerability.