PT-2023-3146 · Riot-Os · Riot-Os

Scepticz + 1 · Publicado 2023-05-30 · Atualizado 2023-06-06 · CVE-2023-33974

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions RIOT-OS versions 2023.01 and prior

Description The issue is related to a 6LoWPAN frame handler in the RIOT operating system kernel, which is connected to pointer dereference errors. An attacker can exploit this issue by sending multiple crafted frames to the device, triggering a race condition that leads to an invalid memory access and results in a denial of service.

Recommendations For versions 2023.01 and prior, update to a version that includes the patch from pull request 19679 to resolve the issue. As a temporary workaround, consider restricting access to the network stack to minimize the risk of exploitation.

Exploit

Correção

NULL Pointer Dereference

Race Condition

Enumeração de Fraquezas

CWE-476

CWE-362

Identificadores relacionados

BDU:2023-03245

BDU:2023-03246

CVE-2023-33974

GHSA-8M3W-MPHF-WXM8

Produtos afetados

Riot-Os

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33974.json · Exploit
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-r2pv-3jqc-vh7w · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L617 · Nota
• https://github.com/RIOT-OS/RIOT/commit/c9d7863e5664a169035038628029bb07e090c5ff · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1067 · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1511 · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1655 · Nota
• https://github.com/RIOT-OS/RIOT/pull/19678 · Nota
• https://github.com/RIOT-OS/RIOT/pull/19679 · Correção
• https://github.com/RIOT-OS/RIOT/blob/master/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L1586 · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1495 · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1644 · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L509 · Nota
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-8m3w-mphf-wxm8 · Aviso do Fabricante
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L1717 · Nota