Alta Aware — 995: Concurrency bugs (missing unlocks) could lead to loss of availability or integrity

Release Date

5th of January 2024.

Overview

Due to concurrency bugs (missing unlocks), the availability or integrity of the Alta Aware and Alta cameras could be affected.

Affected Products

• Alta Aware:
  • All Stable upgrade channel versions before 6.4.4 .
  • All Beta upgrade channel versions before 6.4.4 .
• Alta cameras:
  • All Stable upgrade Channel versions before 6.4.4 .
  • All Beta upgrade channel versions before 6.4.4 .

Unaffected Products

• Alta Aware:

• All Stable upgrade channel versions after and including 6.4.4 .

  • All Beta upgrade channel versions after and including 6.4.4 .

• Alta cameras:

• All Stable upgrade channel versions after and including 6.4.4 .

  • All Beta upgrade channel versions after and including 6.4.4 .

• Alta Cloud: all versions

Resolution

This issue has been fixed in Alta Aware Beta upgrade channel version 6.4.4 and Stable upgrade channel version 6.4.4 .

It is highly recommended that all installations running an affected version are upgraded to the latest release as soon as possible. Releases are available to download through the Alta Aware User Interface.

This issue has been fixed in Alta camera Beta upgrade channel version 6.4.4 and Stable upgrade channel version 6.4.4 .

It is highly recommended that all Alta camera installations running an affected version upgrade to the latest release as soon as possible. Releases are available to download through the Alta Aware User Interface for Alta managed cameras and the Alta camera User Interface for unmanaged Alta cameras.

Vulnerability Information

• CVSSv3 score: 8.2
• CVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Mitigations

There are no known mitigations for this issue.

Work arounds

There are no known work arounds for this issue.

Acknowledgements

Issue found internally by Alta Security.

Disclosure Timeline

• 21/11/2023 Issue found internally by Alta Security
• 24/11/2023 Root cause established
• 25/11/2023 Fix identified
• 09/11/2023 Patched Alta Aware (Beta upgrade channel) released
• 04/12/2023 Patched Alta Aware (Stable upgrade channel) released
• 09/11/2023 Patched Alta cameras (Beta upgrade channel) released
• 04/12/2023 Patched Alta cameras (Stable upgrade channel) released
• 05/12/2024 Vulnerability publicly disclosed