CVE-2021-32771highCWE-120

CVE-2021-32771: falha de alta gravidade em contiki-ng

Buffer overflow in contiki-ng

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar contiki-ng

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 1.4%
Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have joined an RPL DODAG. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits. The problem was fixed after the release of Contiki-NG 4.7. Users unable to upgrade may apply the patch in Contiki-NG PR #1615.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
contiki-ng · contiki-ng
CVEs relacionadas — contiki-ng

No mesmo produto, das mais perigosas para as menos.

CVE-2022-35927HIGHUnverified DIO prefix info lengths in RPL-Classic in Contiki-NGEPSS 2.2%CVE-2022-35926MEDIUMOut-of-bounds read in IPv6 neighbor solicitation in Contiki-NGEPSS 1.3%CVE-2021-21410HIGHOut-of-bounds read in the 6LoWPAN implementationEPSS 1.2%CVE-2021-21257HIGHOut-of-bounds write in RPL-Classic and RPL-LiteEPSS 1.1%CVE-2021-21280HIGHOut-of-bounds write when processing 6LoWPAN extension headersEPSS 1.1%CVE-2021-21282HIGHBuffer overflow in RPL source routing header processingEPSS 1.0%