PT-2023-19807 · Riot-Os · Riot-Os

Diff-Fusion · Published 2023-05-30 · Updated 2023-06-07 · CVE-2023-24825

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RIOT-OS versions prior to 2023.04

Description The issue affects the network stack of RIOT-OS, specifically its ability to process 6LoWPAN frames. An attacker can send a crafted frame to trigger a NULL pointer dereference, leading to denial of service. There are no known workarounds for this issue.

Recommendations For versions prior to 2023.04, update to version 2023.04 to resolve the issue.

Exploit

Fix

Unchecked Return Value

NULL Pointer Dereference

Weakness Enumeration

CWE-252

CWE-476

Related Identifiers

CVE-2023-24825

GHSA-XQM8-XJ74-FJW2

Affected Products

Riot-Os

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24825.json · Exploit
• https://github.com/RIOT-OS/RIOT/commit/0c522075445a62ce3102e141573ecc2788521897 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L729 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xqm8-xj74-fjw2 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L169 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L416 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24825 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24825 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L761 · Note