CVE-2023-24825: high-severity vulnerability in RIOT-OS RIOT
RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
RIOT-OS, an operating system for IoT devices, can crash when it receives a specially crafted network frame because the code doesn't properly check if a pointer is valid before using it. An attacker can exploit this to disable the device.
A NULL pointer dereference vulnerability in the gnrc_pktbuf_mark function of RIOT-OS network stack allows a remote attacker to send a malformed 6LoWPAN frame that triggers unchecked pointer dereference, resulting in denial of service. The vulnerability requires network access to the IoT device but no authentication or privilege escalation.
In the same product, most dangerous first.