CVE-2024-46304

What it actually does

NULL pointer dereference in coap_handle_request_put_block allows remote unauthenticated attackers to crash the process handling CoAP block-wise transfers.

Why it matters to the business

Applications relying on libcoap for constrained-device communication can experience sudden service outages and require manual restarts, increasing operational overhead until patched.

How an attack unfolds

An attacker sends a crafted CoAP PUT request with block-wise transfer options that reaches the vulnerable function, triggering the NULL dereference and terminating the server process.

How to fix it

Upgrade libcoap to a version newer than 4.3.5-rc2 that contains the NULL-pointer fix; recompile and redeploy all dependent services; validate the update with regression tests for block-wise transfers.

How to confirm the fix worked

Confirm the running libcoap version is greater than 4.3.5-rc2; attempt a controlled block-wise PUT request in a test environment and verify the process no longer crashes.

Typical attack path

1. Identify publicly reachable CoAP endpoints using libcoap
2. Craft a PUT request containing block options that forces the NULL path
3. Transmit the request to trigger the dereference and crash
4. Repeat to maintain denial of service

How to detect it

Monitor process crash logs for segmentation faults originating from coap_block.c or the coap_handle_request_put_block symbol; correlate with incoming CoAP PUT traffic containing block options from unexpected sources.

• coap_handle_request_put_block
• src/coap_block.c
• segmentation fault.*coap

What your security team should do

• Prioritize upgrade of all libcoap instances within the next maintenance window
• Add CoAP endpoint reachability and version checks to asset inventory
• Enable process monitoring and automatic restart for CoAP services until patched
• Review network ACLs to restrict untrusted CoAP traffic where feasible