Out-of-bounds read vulnerability in Contiki-NG operating system

CVE-2023-50926

What is CVE-2023-50926?

The out-of-bounds read vulnerability in the Contiki-NG operating system for Next-Generation IoT devices arises from an unvalidated prefix length field in an incoming DIO message during the use of the RPL-Lite implementation. This flaw allows an attacker to exploit the system by providing an oversized value for the IPv6 address prefix length, leading to a potentially damaging memcmp function call that exceeds the allocated array boundary for the prefix. As a result, this vulnerability could enable unauthorized data access and compromise the integrity of the system. To mitigate risks, users are strongly urged to promptly update their installations or manually apply corrections as noted in Contiki-NG pull request #2721.

References