Buffer Over-read Vulnerability in Contiki-NG tinyDTLS
CVE-2021-42147

9.1CRITICAL

Key Information:

Vendor

Contiki-ng

Status
Tinydtls
Vendor
CVE Published:
24 January 2024

What is CVE-2021-42147?

A buffer over-read vulnerability exists in the dtls_sha256_update function of Contiki-NG's tinyDTLS, present through the master branch version 53a0d97. This vulnerability can be exploited by remote attackers, enabling them to cause a denial of service by sending specially crafted data packets. The improper handling of these packets could lead to unintended memory access, impacting the overall reliability and performance of affected services.

References

https://seclists.org/fulldisclosure/2024/Jan/20

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.