PT-2022-10093 · Unknown · Contiki-Ng

Joakimeriksson · Published 2022-08-04 · Updated 2022-08-10 · CVE-2021-32771

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contiki-NG versions prior to 4.7

Description Contiki-NG is an open-source, cross-platform operating system for IoT devices. A buffer overflow can occur when copying an IPv6 address prefix in the RPL-Classic implementation. To trigger this issue, the Contiki-NG system must have joined an RPL DODAG, and then an attacker can send a DAO packet with a Target option containing a prefix length larger than 128 bits.

Recommendations For versions prior to 4.7, update to Contiki-NG 4.7 or apply the patch in Contiki-NG PR #1615 to resolve the issue. As a temporary workaround, consider restricting the ability to send DAO packets with large prefix lengths until the patch is applied.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-32771

GHSA-JQJF-V7V9-XP6W

Affected Products

Contiki-Ng

References · 8

• https://github.com/contiki-ng/contiki-ng/pull/1615 · Patch
• https://github.com/contiki-ng/contiki-ng/pull/1615/commits/587ae59956e00316fd44fd7072ac3a6a07b4b20f · Patch
• https://osv.dev/vulnerability/CVE-2021-32771 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32771 · Security Note
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-jqjf-v7v9-xp6w · Note
• https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.8 · Note
• https://t.me/cvenotify/34500 · Telegram Post
• https://t.me/cibsecurity/47595 · Telegram Post