Chrysn

**Name of the Vulnerable Software and Affected Versions** RIOT-OS versions prior to 2022.10 **Description** The issue arises from a type confusion between IPv6 extension headers and a UDP header while encoding a 6LoWPAN IPHC header in the network stack. This type confusion results in an out of bounds write in the packet buffer, potentially leading to denial of service by corrupting other packets and the allocator metadata. Furthermore, an attacker can manipulate the allocator metadata to write data to arbitrary locations, thus enabling the execution of arbitrary code. **Recommendations** For versions prior to 2022.10, update to version 2022.10 to resolve the issue. As a temporary workaround for versions prior to 2022.10, apply the patches manually.

**Name of the Vulnerable Software and Affected Versions** RIOT-OS version 2021.01 **Description** The issue allows attackers to break encryption by triggering reboots due to nonce reuse in 802.15.4 encryption in the ieee820154 security component. **Recommendations** For RIOT-OS version 2021.01, consider disabling the ieee820154 security component until a patch is available to prevent nonce reuse and potential encryption breaks.