// For flags

CVE-2021-42143

 

Severity Score

9.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.

Se descubrió un problema en Contiki-NG tinyDTLS a través de la rama maestra 53a0d97. Existe un error de bucle infinito durante el manejo de un mensaje de protocolo de enlace ClientHello. Este error permite a atacantes remotos provocar una denegación de servicio enviando un mensaje de protocolo de enlace ClientHello mal formado con una longitud impar de conjuntos de cifrado, lo que desencadena un bucle infinito (consumiendo todos los recursos) y una sobrelectura del búfer que puede revelar información confidencial.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-10-11 CVE Reserved
  • 2024-01-18 CVE Published
  • 2024-02-01 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CAPEC
References (1)
URL Tag Source
https://seclists.org/fulldisclosure/2024/Jan/16 Mailing List
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Contiki-ng
Search vendor "Contiki-ng"
 Tinydtls
Search vendor "Contiki-ng" for product "Tinydtls"
 <= 2018-08-30
Search vendor "Contiki-ng" for product "Tinydtls" and version " <= 2018-08-30"
-
Affected