PT-2022-26196 · Unknown · Contiki-Ng

Diff-Fusion + 2 · Published 2022-12-16 · Updated 2022-12-27 · CVE-2022-41972

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Contiki-NG versions prior to 4.9

Description The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack that is vulnerable to a NULL Pointer Dereference in the BLE L2CAP module. An attacker can inject a packet into this stack, causing the implementation to dereference a NULL pointer and trigger undefined behavior. This occurs while processing the L2CAP protocol, where the implementation maps an incoming channel ID to its metadata structure. The input l2cap credit function in the os/net/mac/ble/ble-l2cap.c module manages state information regarding credits but does not check if the metadata corresponding to the user-supplied channel ID exists, potentially leading to a NULL pointer dereference.

Recommendations For Contiki-NG versions prior to 4.9, apply the patch in Contiki-NG pull request #2253 as a workaround until the new package is released. As a temporary workaround, consider restricting access to the BLE L2CAP module to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2022-41972

GHSA-24XP-G5GF-6VVM

Affected Products

Contiki-Ng

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41972.json · Exploit
• https://github.com/contiki-ng/contiki-ng/pull/2253 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41972 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41972 · Vendor Advisory
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-24xp-g5gf-6vvm · Note
• https://t.me/cibsecurity/54766 · Telegram Post
• https://t.me/cvenotify/40804 · Telegram Post