PT-2021-22029 · Contiki · Contiki

Jerrytesting · Published 2021-08-09 · Updated 2021-08-17 · CVE-2021-38311

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Contiki version 3.0

Description: The issue exists in the Telnet service of Contiki, where potential nonterminating acknowledgment loops can occur. When negotiated options are already disabled, servers still respond to DONT and WONT requests with WONT or DONT commands. This may lead to infinite acknowledgment loops, denial of service, and excessive CPU consumption.

Recommendations: For Contiki version 3.0, as a temporary workaround, consider disabling the Telnet service until a patch is available. Restrict access to the Telnet module to minimize the risk of exploitation. Avoid using the DONT and WONT requests in the affected Telnet service until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2021-38311

Affected Products

Contiki

References · 5

• 🔥 https://github.com/contiki-os/contiki/issues/2685 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38311 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38311 · Vendor Advisory
• https://t.me/cvenotify/18937 · Telegram Post
• https://t.me/cibsecurity/27041 · Telegram Post