CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50926 – Unvalidated DIO prefix info length in RPL-Lite in Contiki-NG
https://notcve.org/view.php?id=CVE-2023-50926
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message contains a field that specifies the length of an IPv6 address prefix. The value of this field is not validated, which means that an attacker can set a value that is longer than the maximum prefix length. Subsequently, a memcmp function call that compares different prefixes can be called with a length argument that surpasses the boundary of the array allocated for the prefix, causing an out-of-bounds read. • https://github.com/contiki-ng/contiki-ng/pull/2721 https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-jp4p-fq85-jch2 • CWE-125: Out-of-bounds Read •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50927 – Insufficient boundary checks for DIO and DAO messages in RPL-Lite in Contiki-NG
https://notcve.org/view.php?id=CVE-2023-50927
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. • https://github.com/contiki-ng/contiki-ng/pull/2484 https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9423-rgj4-wjfw • CWE-125: Out-of-bounds Read •
CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48229 – Out-of-bounds write in the radio driver for Contiki-NG nRF platforms
https://notcve.org/view.php?id=CVE-2023-48229
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds write exists in the driver for IEEE 802.15.4 radios on nRF platforms in the Contiki-NG operating system. The problem is triggered when parsing radio frames in the `read_frame` function in the `arch/cpu/nrf/net/nrf-ieee-driver-arch.c` module. More specifically, the `read_frame` function performs an incomplete validation of the payload length of the packet, which is a value that can be set by an external party that sends radio packets to a Contiki-NG system. Although the value is validated to be in the range of the MTU length, it is not validated to fit into the given buffer into which the packet will be copied. • https://github.com/contiki-ng/contiki-ng/pull/2741 https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-rcwv-xwc9-5hp2 • CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37459 – Out-of-bounds read when processing a received IPv6 packet
https://notcve.org/view.php?id=CVE-2023-37459
Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify that a full TCP header has been received. Specifically, the implementation attempts to access the flags field from the TCP buffer in the following conditional expression in the `check_for_tcp_syn` function. For this reason, an attacker can inject a truncated TCP packet, which will lead to an out-of-bound read from the packet buffer. • https://github.com/contiki-ng/contiki-ng/pull/2510 https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-6648-m23r-hq8c • CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37281 – Out-of-bounds read during IPHC address decompression
https://notcve.org/view.php?id=CVE-2023-37281
Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header decompression, Contiki-NG confirms the received packet buffer contains enough data as needed for that field. But no similar check is done before decompressing the IPv6 address. Therefore, up to 16 bytes can be read out of bounds on the line with the statement `memcpy(&ipaddr->u8[16 - postcount], iphc_ptr, postcount);`. The value of `postcount` depends on the address compression used in the received packet and can be controlled by the attacker. • https://github.com/contiki-ng/contiki-ng/pull/2509 https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-2v4c-9p48-g9pr • CWE-125: Out-of-bounds Read •