PT-2023-3146 · Riot-Os · Riot-Os

Scepticz + 1 · Published 2023-05-30 · Updated 2023-06-06 · CVE-2023-33974

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions RIOT-OS versions 2023.01 and prior

Description The issue is related to a 6LoWPAN frame handler in the RIOT operating system kernel, which is connected to pointer dereference errors. An attacker can exploit this issue by sending multiple crafted frames to the device, triggering a race condition that leads to an invalid memory access and results in a denial of service.

Recommendations For versions 2023.01 and prior, update to a version that includes the patch from pull request 19679 to resolve the issue. As a temporary workaround, consider restricting access to the network stack to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Race Condition

Weakness Enumeration

CWE-476

CWE-362

Related Identifiers

BDU:2023-03245

BDU:2023-03246

CVE-2023-33974

GHSA-8M3W-MPHF-WXM8

Affected Products

Riot-Os

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33974.json · Exploit
• https://github.com/RIOT-OS/RIOT/pull/19679 · Patch
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-8m3w-mphf-wxm8 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/commit/31c6191f6196f1a05c9765cffeadba868e3b0723 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-33974 · Security Note
• https://bdu.fstec.ru/vul/2023-03246 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33974 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03245 · Security Note
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-r2pv-3jqc-vh7w · Note
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L617 · Note
• https://github.com/RIOT-OS/RIOT/commit/c9d7863e5664a169035038628029bb07e090c5ff · Note
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1067 · Note
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1511 · Note
• https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1655 · Note
• https://github.com/RIOT-OS/RIOT/pull/19678 · Note