Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input

CVE-2023-34101

What is CVE-2023-34101?

Contiki-NG, an operating system designed for Internet of Things (IoT) devices, contains a vulnerability in its handling of ICMP DAO packets within the dao_input_storing function. In versions up to 4.8, the system fails to adequately verify whether the buffer size is sufficient before attempting to read data. This oversight permits an attacker to exploit the system by sending a truncated ICMP packet, leading to potential out-of-bounds read situations of up to 16 bytes. The issue has been addressed in the 'develop' branch of Contiki-NG, with the fix slated for inclusion in version 4.9. For immediate mitigation, affected users can apply the necessary changes as outlined in pull request #2435.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References