PT-2023-23165 · Unknown · Contiki-Ng

Diff-Fusion + 2 · Published 2023-05-08 · Updated 2023-05-15 · CVE-2023-31129

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Contiki-NG versions 4.8 and prior

Description The issue arises from the message handling code for IPv6 router solicitations in Contiki-NG, which contains an implementation of IPv6 Neighbor Discovery (ND) in the module os/net/ipv6/uip-nd6.c. The ND protocol includes a message type called Router Solicitation (RS), used to locate routers and update their address information via the SLLAO (Source Link-Layer Address Option). If the indicated source address changes, a given neighbor entry is set to the STALE state. The message handler does not check for RS messages with an SLLAO that indicates a link-layer address change, leading to the dereference of a NULL pointer of type uip ds6 nbr t.

Recommendations For Contiki-NG versions 4.8 and prior, apply Contiki-NG pull request #2271 to patch the problem directly as a workaround. The problem has been patched in the develop branch of Contiki-NG, and will be included in the upcoming 4.9 release.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2023-31129

GHSA-X29R-5QJG-75MQ

Affected Products

Contiki-Ng

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31129.json · Exploit
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-x29r-5qjg-75mq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31129 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31129 · Vendor Advisory
• https://github.com/contiki-ng/contiki-ng/pull/2271 · Note
• https://t.me/cvenotify/50001 · Telegram Post