PT-2024-35992 · Riot · Riot

Havingathijs · Published 2024-11-29 · Updated 2025-09-05 · CVE-2024-53980

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: RIOT (affected versions not specified)

Description: A malicious actor can send a IEEE 802.15.4 packet with a spoofed length byte and optionally a spoofed FCS, resulting in an endless loop on a CC2538 receiver. The issue arises from the receiver checking the location of the CRC bit using the packet length byte, considering all 8 bits instead of discarding bit 7. This leads to reading outside of the RX FIFO, causing a discrepancy in the CRC check between the firmware and the radio. If the CPU judges the CRC as correct and the radio is set to AUTO ACK, the CPU will enter an endless loop when waiting for an acknowledgment.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2024-53980

GHSA-M75Q-8VJ8-WPPW

Affected Products

Riot

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53980.json · Exploit
• https://github.com/RIOT-OS/RIOT/pull/20998 · Patch
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-m75q-8vj8-wppw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53980 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53980 · Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L417 · Note
• https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L183 · Note
• https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/sys/net/link_layer/ieee802154/submac.c#L149 · Note
• https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L419 · Note
• https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L421-L422 · Note
• https://twitter.com/CVEnew/status/1862575401983254820 · Twitter Post
• https://t.me/cveNotify/134387 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1862844469709529300 · Twitter Post