// For flags

CVE-2021-21279

Infinite loop in IPv6 neighbor solicitation processing

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation (NS) messages. This type of attack can effectively shut down the operation of the system because of the cooperative scheduling used for the main parts of Contiki-NG and its communication stack. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaround.

Contiki-NG es un sistema operativo de código abierto y multiplataforma para dispositivos del Internet de las cosas. En las versiones anteriores a 4.6, un atacante puede llevar a cabo un ataque de denegación de servicio al desencadenar un bucle infinito en el procesamiento de los mensajes de neighbor solicitation (NS) IPv6. Este tipo de ataque puede interrumpir efectivamente la operación del sistema debido a la programación cooperativa usada para las partes principales de Contiki-NG y su pila de comunicaciones. El problema ha sido parcheado en Contiki-NG versión 4.6. Los usuarios pueden aplicar el parche para esta vulnerabilidad fuera de límite como solución alternativa

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-22 CVE Reserved
  • 2021-06-18 CVE Published
  • 2024-03-03 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Contiki-ng
Search vendor "Contiki-ng"
 Contiki-ng
Search vendor "Contiki-ng" for product "Contiki-ng"
 < 4.6
Search vendor "Contiki-ng" for product "Contiki-ng" and version " < 4.6"
-
Affected