PT-2023-19798 · Riot-Os · Riot-Os

Diff-Fusion · Published 2023-05-30 · Updated 2023-06-07 · CVE-2023-24817

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RIOT-OS versions prior to 2023.04

Description The issue affects the network stack of RIOT-OS, specifically in the processing of 6LoWPAN frames. An attacker can send a crafted frame, resulting in an integer underflow and out of bounds access in the packet buffer. This can lead to corruption of other packets or the allocator metadata, and potentially cause a denial of service if a pointer is corrupted.

Recommendations For versions prior to 2023.04, update to version 2023.04 to resolve the issue. As a temporary workaround, consider disabling SRH in the network stack until the update is applied.

Exploit

Fix

Integer Underflow

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-191

CWE-787

CWE-119

Related Identifiers

CVE-2023-24817

GHSA-XJGW-7638-29G5

Affected Products

Riot-Os

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24817.json · Exploit
• https://github.com/RIOT-OS/RIOT/commit/34dc1757f5621be48e226cfebb2f4c63505b5360 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xjgw-7638-29g5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24817 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24817 · Vendor Advisory