PT-2021-22919 · Contiki · Contiki

Jerrytesting · Published 2021-09-05 · Updated 2021-09-10 · CVE-2021-40523

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Contiki version 3.0

Description The issue arises from mishandled Telnet option negotiation between a server and a client. Specifically, the server may fail to provide the necessary WILL/WONT or DO/DONT response for DO and WILL commands due to improper handling of exception conditions. This can lead to property violations and denial of service. The problem occurs because a fixed buffer space is allocated for all responses, and this space may become exhausted, causing the server to send no response.

Recommendations For Contiki version 3.0, consider implementing proper exception handling for Telnet option negotiations to prevent buffer exhaustion and ensure the server provides the required responses for DO and WILL commands. As a temporary workaround, consider restricting or closely monitoring Telnet negotiations to minimize the risk of denial of service.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2021-40523

Affected Products

Contiki

References · 5

• https://github.com/contiki-os/contiki/issues/2686 · Patch
• https://osv.dev/vulnerability/CVE-2021-40523 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40523 · Security Note
• https://t.me/cvenotify/20674 · Telegram Post
• https://t.me/cibsecurity/28270 · Telegram Post