Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input

CVE-2023-34101

What is CVE-2023-34101?

Contiki-NG, an operating system designed for Internet of Things (IoT) devices, contains a vulnerability in its handling of ICMP DAO packets within the dao_input_storing function. In versions up to 4.8, the system fails to adequately verify whether the buffer size is sufficient before attempting to read data. This oversight permits an attacker to exploit the system by sending a truncated ICMP packet, leading to potential out-of-bounds read situations of up to 16 bytes. The issue has been addressed in the 'develop' branch of Contiki-NG, with the fix slated for inclusion in version 4.9. For immediate mitigation, affected users can apply the necessary changes as outlined in pull request #2435.

References