PT-2023-3147 · Riot-Os · Riot-Os

Diff-Fusion · Publicado 2023-05-30 · Atualizado 2023-06-06 · CVE-2023-33973

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions RIOT-OS versions 2023.01 and prior

Description The issue is related to the processing of 6LoWPAN frames in the network stack of RIOT-OS, an operating system for Internet of Things (IoT) devices. An attacker can send a crafted frame that, when forwarded by the device, causes a NULL pointer dereference during packet encoding, leading to a denial of service as the device crashes. There are no known workarounds for this issue.

Recommendations For versions 2023.01 and prior, apply the patch available at pull request 19678 to resolve the issue. As a temporary workaround, consider restricting the ability of the device to forward crafted 6LoWPAN frames until the patch is applied.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

BDU:2023-03246

CVE-2023-33973

GHSA-R2PV-3JQC-VH7W

Produtos afetados

Riot-Os

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33973.json · Exploit
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-r2pv-3jqc-vh7w · Aviso do Fabricante
• https://github.com/RIOT-OS/RIOT/commit/c9d7863e5664a169035038628029bb07e090c5ff · Correção
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1067 · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1511 · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1655 · Nota
• https://github.com/RIOT-OS/RIOT/pull/19678 · Correção
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1644 · Nota
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1495 · Nota
• https://osv.dev/vulnerability/CVE-2023-33973 · Aviso do Fabricante
• https://t.me/cvenotify/51396 · Publicação no Telegram
• https://t.me/cvenotify/51382 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-03246 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-33973 · Nota de Segurança
• https://avd.aquasec.com/nvd/2023/cve-2023-33974 · Nota