CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12140
https://notcve.org/view.php?id=CVE-2020-12140
A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code via malicious L2CAP frames. Un desbordamiento de búfer en el archivo os/net/mac/ble/ble-l2cap.c en la pila BLE en Contiki-NG versiones 4.4 y anteriores, permite a un atacante ejecutar código arbitrario por medio de tramas L2CAP maliciosas • https://github.com/contiki-ng/contiki-ng/pull/1662 https://twitter.com/ScepticCtf • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12141
https://notcve.org/view.php?id=CVE-2020-12141
An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclose information via crafted SNMP packets to snmp_ber_decode_string_len_buffer in os/net/app-layer/snmp/snmp-ber.c. Una lectura fuera de límites en la pila SNMP de Contiki-NG versiones 4.4 y anteriores, permite a un atacante causar una denegación de servicio y potencialmente revelar información por medio de paquetes SNMP diseñados en la función snmp_ber_decode_string_len_buffer en el archivo os/net/app-layer/snmp/snmp-ber.c • https://github.com/contiki-ng/contiki-ng/commit/12c824386ab60de757de5001974d73b32e19ad71#diff-32367fad664c6118fd5dda77cdf38eedc006cdd7544eca5bbeebe0b99653f8a0 https://github.com/contiki-ng/contiki-ng/pull/1355 https://twitter.com/ScepticCtf • CWE-125: Out-of-bounds Read •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21410 – Out-of-bounds read in the 6LoWPAN implementation
https://notcve.org/view.php?id=CVE-2021-21410
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function (<code>uncompress_hdr_iphc</code>) does not perform proper boundary checks when reading from the packet buffer. Hence, it is possible to construct a compressed 6LoWPAN packet that will read more bytes than what is available from the packet buffer. As of time of publication, there is not a release with a patch available. • https://github.com/contiki-ng/contiki-ng/pull/1482 https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-hhwj-2p59-v8p9 • CWE-125: Out-of-bounds Read •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21257 – Out-of-bounds write in RPL-Classic and RPL-Lite
https://notcve.org/view.php?id=CVE-2021-21257
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system versions prior to 4.6 do not validate the address pointer in the RPL source routing header This makes it possible for an attacker to cause out-of-bounds writes with packets injected into the network stack. Specifically, the problem lies in the rpl_ext_header_srh_update function in the two rpl-ext-header.c modules for RPL-Classic and RPL-Lite respectively. The addr_ptr variable is calculated using an unvalidated CMPR field value from the source routing header. An out-of-bounds write can be triggered on line 151 in os/net/routing/rpl-lite/rpl-ext-header.c and line 261 in os/net/routing/rpl-classic/rpl-ext-header.c, which contain the following memcpy call with addr_ptr as destination. • https://github.com/contiki-ng/contiki-ng/pull/1431 https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-mvc7-9p4q-c5cm • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21279 – Infinite loop in IPv6 neighbor solicitation processing
https://notcve.org/view.php?id=CVE-2021-21279
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation (NS) messages. This type of attack can effectively shut down the operation of the system because of the cooperative scheduling used for the main parts of Contiki-NG and its communication stack. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaround. • https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-rr5j-j8m8-fc4f • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •