PT-2024-32463 · Unknown · Contiki-Ng

Nfip · Published 2024-11-27 · Updated 2024-11-27 · CVE-2024-47181

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Contiki-NG versions prior to the next release after 4.9

Description The issue is related to an unaligned memory access in the Contiki-NG operating system, specifically in its two RPL implementations. This can be triggered when an IPv6 packet contains an odd number of padded bytes before the RPL option, causing the rpl ext header hbh update function to read a 16-bit integer from an odd address. The impact of this unaligned read is architecture-dependent but can potentially cause the system to crash.

Recommendations For versions prior to the next release after 4.9, apply the changes in Contiki-NG pull request #2962 to patch the system or wait for the next release. As a temporary workaround, consider restricting the use of the RPL implementations until a patch is available.

Exploit

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2024-47181

GHSA-CRJW-X84H-H6X3

Affected Products

Contiki-Ng

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47181.json · Exploit
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-crjw-x84h-h6x3 · Vendor Advisory
• https://github.com/contiki-ng/contiki-ng/pull/2962 · Patch
• https://osv.dev/vulnerability/CVE-2024-47181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47181 · Security Note
• https://twitter.com/CVEnew/status/1861844083334848722 · Twitter Post