VulnerabilityDeferred

CVE-2024-56317

If input validation fails during decoding, the process stops, and no entries are restored by access-control-server.cpp, i.e., a denial of service.

HIGH 7.5EPSS 0.37%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes all existing ACL entries first, and then attempts to recreate them based on user input. If input validation fails during decoding, the process stops, and no entries are restored by access-control-server.cpp, i.e., a denial of service.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.37% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-281
Source: cve@mitre.org

References

https://github.com/project-chip/connectedhomeip/issues/36535

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.