CVE-2024-56317

Summary

In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes all existing ACL entries first, and then attempts to recreate them based on user input. If input validation fails during decoding, the process stops, and no entries are restored by access-control-server.cpp, i.e., a denial of service.

Affected Software

VendorProductVersion RangeStatus
MatterMatter0 <= 1.4.0.0affected

Weaknesses

  • CWE-281: CWE-281 Improper Preservation of Permissions

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

References