Buffer Overflow Vulnerability in RIOT Operating System Could Lead to Denial of Service or Arbitrary Code Execution

CVE-2024-32017

What is CVE-2024-32017?

In particular, a small typo in the size check within the gcoap_dns_server_proxy_get() function of RIOT OS can result in a buffer overflow during the execution of strcpy(). This is due to the system incorrectly checking the length of the _uri string instead of the _proxy string. Additionally, the _gcoap_forward_proxy_copy_options() function lacks sufficient bounds checking before writing to the cep->req_etag, which is restricted by COAP_ETAG_LENGTH_MAX. An attacker could exploit this vulnerability by crafting input that makes optlen exceed COAP_ETAG_LENGTH_MAX, leading to scenarios that could result in denial of service or arbitrary code execution if the input crosses security boundaries. Currently, no patch exists for this issue, highlighting the need for manual bounds checks by users.

References