PT-2024-13557 · Unknown · Contiki-Ng

Scepticz · Published 2024-02-14 · Updated 2025-01-06 · CVE-2023-48229

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Contiki-NG (affected versions not specified)

Description An out-of-bounds write exists in the driver for IEEE 802.15.4 radios on nRF platforms in the Contiki-NG operating system. The issue is triggered when parsing radio frames in the read frame function in the arch/cpu/nrf/net/nrf-ieee-driver-arch.c module. The read frame function performs an incomplete validation of the payload length of the packet, which can be set by an external party. Although the value is validated to be in the range of the MTU length, it is not validated to fit into the given buffer into which the packet will be copied.

Recommendations As a temporary workaround, consider manually applying the changes in PR #2741 until a patch is available. Update the develop branch or update to a subsequent release when available to resolve the issue. Users unable to upgrade should consider applying the above workaround to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-48229

GHSA-RCWV-XWC9-5HP2

Affected Products

Contiki-Ng

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48229.json · Exploit
• https://github.com/contiki-ng/contiki-ng/pull/2741 · Patch
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-rcwv-xwc9-5hp2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48229 · Security Note
• https://twitter.com/cracbot/status/1758008328528200175 · Twitter Post
• https://twitter.com/CVEnew/status/1757840663478178216 · Twitter Post