PT-2021-14366 · Unknown · Contiki-Ng

Joakim Eriksson · Published 2021-06-18 · Updated 2021-06-24 · CVE-2021-21257

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Contiki-NG versions prior to 4.6

Description: The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system do not validate the address pointer in the RPL source routing header. This allows an attacker to cause out-of-bounds writes with packets injected into the network stack. The issue lies in the rpl ext header srh update function, where the addr ptr variable is calculated using an unvalidated CMPR field value from the source routing header. An out-of-bounds write can be triggered due to a memcpy call with addr ptr as the destination.

Recommendations: For Contiki-NG versions prior to 4.6, update to version 4.6 to resolve the issue. As a temporary workaround, users can apply a patch out-of-band. Consider restricting access to the rpl ext header srh update function in the rpl-ext-header.c modules for RPL-Classic and RPL-Lite until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-21257

GHSA-MVC7-9P4Q-C5CM

Affected Products

Contiki-Ng

References · 5

• https://github.com/contiki-ng/contiki-ng/pull/1431 · Patch
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-mvc7-9p4q-c5cm · Patch
• https://osv.dev/vulnerability/CVE-2021-21257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21257 · Security Note
• https://t.me/cvenotify/16561 · Telegram Post