CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-24819 – RIOT-OS vulnerable to Buffer Overflow during IPHC receive
https://notcve.org/view.php?id=CVE-2023-24819
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. • https://github.com/RIOT-OS/RIOT/pull/18817/commits/73615161c01fcfbbc7216cf502cabb12c1598ee4 https://github.com/RIOT-OS/RIOT/pull/18820/commits/da63e45ee94c03a2e08625b04ea618653eab4a9f https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-fv97-2448-gcf6 • CWE-131: Incorrect Calculation of Buffer Size CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-24818 – RIOT-OS vulnerable to null pointer dereference during fragment forwarding
https://notcve.org/view.php?id=CVE-2023-24818
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference. During forwarding of a fragment an uninitialized entry in the reassembly buffer is used. The NULL pointer dereference triggers a hard fault exception resulting in denial of service. Version 2022.10 fixes this issue. • https://github.com/RIOT-OS/RIOT/pull/18817/commits/0bec3e245ed3815ad6c8cae54673f0021777768b https://github.com/RIOT-OS/RIOT/pull/18817/commits/17c70f7ee0b1445f2941f516f264ed4a096e82b7 https://github.com/RIOT-OS/RIOT/pull/18817/commits/aa27ed71fa3e5d48dee1748dcf27b6323ec98a33 https://github.com/RIOT-OS/RIOT/pull/18820/commits/4b23d93868a28edd8ebf2ff4ebe94540f2475008 https://github.com/RIOT-OS/RIOT/pull/18820/commits/f4df5b4c4f841ccb460930894cf68ab10b55b971 https://github.com/RIOT-OS/RIOT/pull/18820/commits/f4fb746d1acaacc962daeed3aa71aadfe307d20e https:&# • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27427 – RIOT OS Integer Overflow or Wraparound
https://notcve.org/view.php?id=CVE-2021-27427
RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. RIOT OS versión 2020.01.1, es vulnerable a una envoltura de enteros en su implementación de la función calloc, lo que puede conllevar a una asignación arbitraria de memoria, resultando en un comportamiento no esperado como un bloqueo o una inyección/ejecución de código remota • https://github.com/RIOT-OS/RIOT https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-41061
https://notcve.org/view.php?id=CVE-2021-41061
In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component allows attackers to break encryption by triggering reboots. En RIOT-OS versión 2021.01, un re-uso de nonce en el cifrado 802.15.4 en el componente ieee820154_security permite a atacantes romper el cifrado al desencadenar reinicios • https://github.com/RIOT-OS/RIOT/issues/16844 • CWE-330: Use of Insufficiently Random Values •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-31660
https://notcve.org/view.php?id=CVE-2021-31660
RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information. RIOT-OS 2021.01 anterior al commit 85da504d2dc30188b89f44c3276fc5a25b31251f, contiene un desbordamiento de búfer que podría permitir a atacantes obtener información confidencial • https://github.com/RIOT-OS/RIOT/commit/85da504d2dc30188b89f44c3276fc5a25b31251f https://github.com/RIOT-OS/RIOT/pull/15947 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •