RIOT-OS vulnerable to Buffer Overflow during IPHC receive

CVE-2023-24819

What is CVE-2023-24819?

The network stack of RIOT-OS, designed for Internet of Things devices, is susceptible to a serious vulnerability that allows an attacker to send a specifically crafted 6LoWPAN frame. This can lead to an out of bounds write within the packet buffer, potentially corrupting additional packets and allocator metadata. By manipulating the allocator data, an attacker might execute arbitrary code or trigger a denial of service. To mitigate this risk, upgrade to version 2022.10 or disable support for fragmented IP datagrams manually.

References