CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36053 – Out-of-bounds read in the uIP buffer module
https://notcve.org/view.php?id=CVE-2022-36053
01 Sep 2022 — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The low-power IPv6 network stack of Contiki-NG has a buffer module (os/net/ipv6/uipbuf.c) that processes IPv6 extension headers in incoming data packets. As part of this processing, the function uipbuf_get_next_header casts a pointer to a uip_ext_hdr structure into the packet buffer at different offsets where extension headers are expected to be found, and then reads from this structure. Because of a lack of bound... • https://github.com/contiki-ng/contiki-ng/pull/1648 • CWE-125: Out-of-bounds Read •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35927 – Unverified DIO prefix info lengths in RPL-Classic in Contiki-NG
https://notcve.org/view.php?id=CVE-2022-35927
04 Aug 2022 — Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating system, an incoming DODAG Information Option (DIO) control message can contain a prefix information option with a length parameter. The value of the length parameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_from_prefix function. This vulnerability affects anyone running a Contiki-NG ... • https://github.com/contiki-ng/contiki-ng/pull/1589 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35926 – Out-of-bounds read in IPv6 neighbor solicitation in Contiki-NG
https://notcve.org/view.php?id=CVE-2022-35926
04 Aug 2022 — Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki-NG, attackers can send neighbor solicitation packets that trigger an out-of-bounds read. The problem exists in the module os/net/ipv6/uip-nd6.c, where memory read operations from the main packet buffer, uip_buf, are not checked if they go out of bounds. In particular, this problem can occur when attempting to read the 2-byte option heade... • https://github.com/contiki-ng/contiki-ng/pull/1654 • CWE-125: Out-of-bounds Read •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32771 – Buffer overflow in contiki-ng
https://notcve.org/view.php?id=CVE-2021-32771
04 Aug 2022 — Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have joined an RPL DODAG. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits. The problem was fixed after the release of Contiki-NG 4.7. • https://github.com/contiki-ng/contiki-ng/pull/1615 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12140
https://notcve.org/view.php?id=CVE-2020-12140
07 Dec 2021 — A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code via malicious L2CAP frames. Un desbordamiento de búfer en el archivo os/net/mac/ble/ble-l2cap.c en la pila BLE en Contiki-NG versiones 4.4 y anteriores, permite a un atacante ejecutar código arbitrario por medio de tramas L2CAP maliciosas • https://github.com/contiki-ng/contiki-ng/pull/1662 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12141
https://notcve.org/view.php?id=CVE-2020-12141
19 Oct 2021 — An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclose information via crafted SNMP packets to snmp_ber_decode_string_len_buffer in os/net/app-layer/snmp/snmp-ber.c. Una lectura fuera de límites en la pila SNMP de Contiki-NG versiones 4.4 y anteriores, permite a un atacante causar una denegación de servicio y potencialmente revelar información por medio de paquetes SNMP diseñados en la función snmp_ber_decode_string_len_... • https://github.com/contiki-ng/contiki-ng/commit/12c824386ab60de757de5001974d73b32e19ad71#diff-32367fad664c6118fd5dda77cdf38eedc006cdd7544eca5bbeebe0b99653f8a0 • CWE-125: Out-of-bounds Read •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21410 – Out-of-bounds read in the 6LoWPAN implementation
https://notcve.org/view.php?id=CVE-2021-21410
18 Jun 2021 — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function (uncompress_hdr_iphc) does not perform proper boundary checks when reading from the packet buffer. Hence, it is possible to construct a compressed 6LoWPAN packet that will read more bytes than what is available from the packet buffer. As of time of publicat... • https://github.com/contiki-ng/contiki-ng/pull/1482 • CWE-125: Out-of-bounds Read •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21257 – Out-of-bounds write in RPL-Classic and RPL-Lite
https://notcve.org/view.php?id=CVE-2021-21257
18 Jun 2021 — Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system versions prior to 4.6 do not validate the address pointer in the RPL source routing header This makes it possible for an attacker to cause out-of-bounds writes with packets injected into the network stack. Specifically, the problem lies in the rpl_ext_header_srh_update function in the two rpl-ext-header.c modules for RPL-Classic and RPL... • https://github.com/contiki-ng/contiki-ng/pull/1431 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21279 – Infinite loop in IPv6 neighbor solicitation processing
https://notcve.org/view.php?id=CVE-2021-21279
18 Jun 2021 — Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation (NS) messages. This type of attack can effectively shut down the operation of the system because of the cooperative scheduling used for the main parts of Contiki-NG and its communication stack. The problem has been patched in Contiki-NG 4.6. Users can apply the p... • https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-rr5j-j8m8-fc4f • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-21280 – Out-of-bounds write when processing 6LoWPAN extension headers
https://notcve.org/view.php?id=CVE-2021-21280
18 Jun 2021 — Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Contiki-NG prior to 4.6 when transmitting a 6LoWPAN packet with a chain of extension headers. Unfortunately, the written header is not checked to be within the available space, thereby making it possible to write outside the buffer. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaroun... • https://github.com/contiki-ng/contiki-ng/pull/1409 • CWE-787: Out-of-bounds Write •