Executive brief
Golioth Pouch, a firmware component for connecting IoT devices to the cloud, contains a security flaw in how it handles Bluetooth Low Energy (BLE) certificates. An attacker within Bluetooth range can send specially crafted data fragments that exceed the device's memory limits. This can lead to a system crash or allow the attacker to corrupt the device's memory, potentially compromising its integrity and operational stability.
Technical details
A heap-based buffer overflow exists in Golioth Pouch version 0.1.0 within the BLE GATT server certificate handling logic. The function `server_cert_write()` in `server_cert_characteristic.c` allocates a heap buffer of size `CONFIG_POUCH_SERVER_CERT_MAX_LEN` upon receiving the first fragment but fails to validate the total size when appending subsequent fragments via `memcpy()`. An unauthenticated attacker within Bluetooth range (adjacent) can exploit this by sending fragments that exceed the maximum length, resulting in a heap overflow. This can cause a denial-of-service (crash) or arbitrary memory corruption. The issue is fixed in commit 1b2219a1.
Affected products
- Golioth Pouch 0.1.0 prior to commit 1b2219a1
Timeline
- 2026-02-26: advisory: Initial disclosure by VulnCheck and SecMate
- 2026-02-26: patched: Fix identified in commit 1b2219a1