libcoap Out-of-Bounds Read Vulnerability in OSCORE CBOR Unwrap Handling

A vulnerability allowing out-of-bounds read has been identified in libcoap versions prior to 4.3.5b. This issue arises in the OSCORE Appendix B.2 CBOR unwrap handling, where the function get_byte_inc() in 'src/oscore/oscore_cbor.c' relies solely on assert() for bounds checking. This assertion is removed in release builds compiled with NDEBUG. Exploitation can occur when attackers send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation. This can trigger out-of-bounds reads during CBOR parsing, potentially leading to heap buffer overflow writes through integer wraparound in allocation size computation.

Impact

Exploitation of this vulnerability causes an out-of-bounds read, which can lead to a heap buffer overflow.

Remediation

Users can upgrade to libcoap version 4.3.5b or later to address this vulnerability.