CVE-2023-24820: high-severity vulnerability in RIOT-OS RIOT
RIOT-OS vulnerable to Integer Underflow during IPHC receive
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.9%
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. An attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault exception after reaching the last page of RAM. The hard fault is not handled and the system will be stuck until reset. Thus the impact is denial of service. Version 2022.10 fixes this issue. As a workaround, apply the patch manually.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
RIOT-OS · RIOTRelated CVEs — RIOT-OS RIOT
In the same product, most dangerous first.
CVE-2024-32017CRITICALBuffer overflows in RIOTEPSS 1.6%CVE-2024-32018HIGHIneffective size check due to assert() and buffer overflow in RIOTEPSS 1.5%CVE-2023-33975CRITICALRIOT-OS vulnerable to Out of Bounds Write in _rbuf_addEPSS 1.5%CVE-2024-31225HIGHLack of size check and buffer overflow in RIOTEPSS 1.3%CVE-2023-24818HIGHRIOT-OS vulnerable to null pointer dereference during fragment forwardingEPSS 1.2%CVE-2023-24823CRITICALRIOT-OS vulnerable to Packet Type Confusion during IPHC sendEPSS 1.0%