// For flags

CVE-2022-36054

Out-of-bounds write when decompressing 6LoWPAN payload in Contiki-NG

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in the Contiki-NG operating system (file os/net/ipv6/sicslowpan.c) contains an input function that processes incoming packets and copies them into a packet buffer. Because of a missing length check in the input function, it is possible to write outside the packet buffer's boundary. The vulnerability can be exploited by anyone who has the possibility to send 6LoWPAN packets to a Contiki-NG system. In particular, the vulnerability is exposed when sending either of two types of 6LoWPAN packets: an unfragmented packet or the first fragment of a fragmented packet. If the packet is sufficiently large, a subsequent memory copy will cause an out-of-bounds write with data supplied by the attacker.

Contiki-NG es un sistema operativo de código abierto y multiplataforma para dispositivos IoT de Próxima Generación. La implementación de 6LoWPAN en el sistema operativo Contiki-NG (archivo os/net/ipv6/sicslowpan.c) contiene una función de entrada que procesa los paquetes entrantes y los copia en un búfer de paquetes. Debido a una falta de comprobación de longitud en la función de entrada, es posible escribir fuera de límites del búfer de paquetes. La vulnerabilidad puede ser explotada por cualquiera que tenga la posibilidad de enviar paquetes 6LoWPAN a un sistema Contiki-NG. En particular, la vulnerabilidad queda expuesta cuando es enviado cualquiera de los dos tipos de paquetes 6LoWPAN: un paquete no fragmentado o el primer fragmento de un paquete fragmentado. Si el paquete es lo suficientemente grande, una copia de memoria posterior causará una escritura fuera de límites con los datos suministrados por el atacante

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-07-15 CVE Reserved
  • 2022-09-01 CVE Published
  • 2024-03-24 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-787: Out-of-bounds Write
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Contiki-ng
Search vendor "Contiki-ng"
 Contiki-ng
Search vendor "Contiki-ng" for product "Contiki-ng"
 < 4.8
Search vendor "Contiki-ng" for product "Contiki-ng" and version " < 4.8"
-
Affected