Matter SDK vulnerabilities

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, in the interaction model command processing logic. Sending an InvokeCommandRequest to a nonexistent endpoint and cluster (e.g., 0x34) causes the code to incorrectly treat the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke, leading to a VerifyOrDie failure in ProcessCommandDataIB and a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0. The `GetDestinationGroupId().Value()` method is called without checking if a value exists, leading to a crash when an InvokeCommand is sent without initializing the destination group ID.

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service).

A reachable assertion vulnerability in Matter SDK (connectedhomeip) before 1.4.2 allows remote denial of service by sending a MoveToLevel command followed by writing OperationMode=2 in the Pump Configuration and Control cluster, causing a server crash.

A reachable assertion vulnerability in Matter SDK versions 1.3 and 1.4 causes device abort after a MoveToLevel command and conflicting write to the OperationMode attribute. The bug in Level Control cluster server tick logic leads to denial of service (DoS).