CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-24819 – RIOT-OS vulnerable to Buffer Overflow during IPHC receive
https://notcve.org/view.php?id=CVE-2023-24819
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. • https://github.com/RIOT-OS/RIOT/pull/18817/commits/73615161c01fcfbbc7216cf502cabb12c1598ee4 https://github.com/RIOT-OS/RIOT/pull/18820/commits/da63e45ee94c03a2e08625b04ea618653eab4a9f https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-fv97-2448-gcf6 • CWE-131: Incorrect Calculation of Buffer Size CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-24818 – RIOT-OS vulnerable to null pointer dereference during fragment forwarding
https://notcve.org/view.php?id=CVE-2023-24818
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference. During forwarding of a fragment an uninitialized entry in the reassembly buffer is used. The NULL pointer dereference triggers a hard fault exception resulting in denial of service. Version 2022.10 fixes this issue. • https://github.com/RIOT-OS/RIOT/pull/18817/commits/0bec3e245ed3815ad6c8cae54673f0021777768b https://github.com/RIOT-OS/RIOT/pull/18817/commits/17c70f7ee0b1445f2941f516f264ed4a096e82b7 https://github.com/RIOT-OS/RIOT/pull/18817/commits/aa27ed71fa3e5d48dee1748dcf27b6323ec98a33 https://github.com/RIOT-OS/RIOT/pull/18820/commits/4b23d93868a28edd8ebf2ff4ebe94540f2475008 https://github.com/RIOT-OS/RIOT/pull/18820/commits/f4df5b4c4f841ccb460930894cf68ab10b55b971 https://github.com/RIOT-OS/RIOT/pull/18820/commits/f4fb746d1acaacc962daeed3aa71aadfe307d20e https:&# • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17389
https://notcve.org/view.php?id=CVE-2019-17389
In RIOT 2019.07, the MQTT-SN implementation (asymcute) mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker (via a large packet) to prevent a RIOT MQTT-SN client from working until the device is restarted. En RIOT versión 2019.07, la implementación MQTT-SN (asymcute) maneja inapropiadamente los errores que ocurren durante una operación de lectura en un socket UDP. El ciclo de recepción finaliza. • https://github.com/RIOT-OS/RIOT/pull/12382 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16754
https://notcve.org/view.php?id=CVE-2019-16754
RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so, the attacker needs to know the MQTT MsgID of a pending MQTT protocol message and the ephemeral port used by RIOT's MQTT implementation. Additionally, the server IP address is required for spoofing the packet. RIOT versión 2019.07, contiene una desreferencia del puntero NULL en la implementación MQTT-SN (asymcute), lo que permite potencialmente a un atacante bloquear un nodo de red que ejecuta RIOT. • https://github.com/RIOT-OS/RIOT/pull/12293 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15702
https://notcve.org/view.php?id=CVE-2019-15702
In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, because sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c has an infinite loop for an unknown zero-length option. En la implementación TCP (gnrc_tcp) en RIOT hasta 2019.07, el analizador de opciones TCP no termina en todas las entradas, lo que permite una denegación de servicio, porque sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c tiene un bucle infinito para un desconocido opción de longitud cero. • https://github.com/RIOT-OS/RIOT/issues/12086 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •