PT-2025-51877 · Riot · Riot

Nils-Bernsdorf · Publicado 2025-12-17 · Atualizado 2026-01-22 · CVE-2025-66646

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RIOT versions prior to 2025.10

Description RIOT is an open-source microcontroller operating system designed for Internet of Things (IoT) devices and other embedded systems. A flaw exists in the IPv6 fragmentation reassembly implementation. Specifically, when processing a fragmented IPv6 packet with a fragment offset of 0 and an empty payload, the payload pointer is set to NULL. The implementation then attempts to copy this payload into the reassembly buffer, leading to a NULL pointer dereference and causing the operating system to crash, resulting in a denial-of-service (DoS). To exploit this, the gnrc ipv6 ext frag module must be enabled, and an attacker needs to be able to send arbitrary IPv6 packets to the target device.

Recommendations Update to RIOT version 2025.10 or later.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2025-66646

GHSA-V8GX-Q9M6-5XM9

Produtos afetados

Riot

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66646.json · Exploit
• 🔥❌ https://github.com/user-attachments/files/23903992/reproducer_1.zip · Exploit, Deleted
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L411 · Nota
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L532 · Nota
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L534 · Nota
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L420 · Nota
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L490 · Nota
• https://github.com/RIOT-OS/RIOT/releases/tag/2025.10 · Nota
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-v8gx-q9m6-5xm9 · Correção
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L544 · Nota
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L150C1-L150C76 · Nota
• https://t.me/CVEtracker/40072 · Publicação no Telegram
• https://t.me/cveNotify/149579 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2002835977685893447 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-66646 · Aviso do Fabricante