RIOT-OS vulnerable to Integer Underflow during defragmentation

CVE-2023-24821

What is CVE-2023-24821?

RIOT-OS, an operating system designed for Internet of Things (IoT) devices, contains a vulnerability in its network stack that processes 6LoWPAN frames. Attackers can exploit this issue by sending specially crafted frames to devices running versions prior to 2022.10. This results in an out-of-bounds write that can cause a hard fault exception once the write exceeds the packet buffer, ultimately leading to a denial of service as the system becomes unresponsive until a manual reset occurs. To mitigate this vulnerability, users are advised to disable support for fragmented IP datagrams or upgrade to version 2022.10 or later.

References