Out-of-bounds read in SNMP decoding in Contiki-NG

CVE-2024-41125

What is CVE-2024-41125?

The Contiki-NG operating system, utilized in various IoT devices, has a vulnerability that may expose devices to an out-of-bounds read scenario. This issue arises during the processing of SNMP packets where the SNMP module is enabled. Specifically, the vulnerability is located in the snmp_ber_decode_string_len_buffer function within the snmp-ber.c module, which fails to correctly validate buffer length when reading data, potentially leading to unintended access to memory outside the allocated buffer. Although the SNMP module is disabled by default in the Contiki-NG configuration, users with this module activated are encouraged to apply the patch from pull request #2936 or disable the SNMP module in their build configuration to mitigate risks until the next release.

References