PT-2023-2963 · Riot-Os · Riot-Os

Diff-Fusion · Published 2023-05-30 · Updated 2023-06-07 · CVE-2023-33975

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RIOT-OS versions 2023.01 and prior

Description The issue concerns the network stack of RIOT-OS, specifically its ability to process 6LoWPAN frames. An attacker can send a crafted frame to the device, resulting in an out of bounds write in the packet buffer. This overflow can be used to corrupt other packets and the allocator metadata, leading to denial of service or potentially allowing the attacker to write data to arbitrary locations and execute arbitrary code.

Recommendations For versions 2023.01 and prior, as a temporary workaround, consider disabling support for fragmented IP datagrams to minimize the risk of exploitation. Update to a version that includes the fix from pull request 19680 to fully resolve the issue.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2023-02972

CVE-2023-33975

GHSA-F6FF-G7MH-58Q4

Affected Products

Riot-Os

References · 16

• 🔥 https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-f6ff-g7mh-58q4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33975.json · Exploit
• https://github.com/RIOT-OS/RIOT/commit/1aeb90ee5555ae78b567a6365ae4ab71bfd1404b · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L320 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L480 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/pull/19680 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L467 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L388 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L463 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02972 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33975 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33975 · Security Note
• https://t.me/cvenotify/51402 · Telegram Post
• https://t.me/cybersecuritytechnologies/8434 · Telegram Post
• https://t.me/pentestingnews/36487 · Telegram Post