CVE-2024-41126: falha de alta gravidade em contiki-ng
Out-of-bounds read when decoding SNMP messages in Contiki-NG
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 0.3%
Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The vulnerability exists in the os/net/app-layer/snmp/snmp-message.c module, where the snmp_message_decode function fails to check the boundary of the message buffer when reading a byte from it immediately after decoding an object identifier (OID). The problem has been patched in Contiki-NG pull request 2937. It will be included in the next release of Contiki-NG. Users are advised to either apply the patch manually or to wait for the next release. A workaround is to disable the SNMP module in the Contiki-NG build configuration.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
contiki-ng · contiki-ngCVEs relacionadas — contiki-ng
No mesmo produto, das mais perigosas para as menos.
CVE-2022-35927HIGHUnverified DIO prefix info lengths in RPL-Classic in Contiki-NGEPSS 2.2%CVE-2021-32771HIGHBuffer overflow in contiki-ngEPSS 1.4%CVE-2022-35926MEDIUMOut-of-bounds read in IPv6 neighbor solicitation in Contiki-NGEPSS 1.3%CVE-2021-21410HIGHOut-of-bounds read in the 6LoWPAN implementationEPSS 1.2%CVE-2021-21257HIGHOut-of-bounds write in RPL-Classic and RPL-LiteEPSS 1.1%CVE-2021-21280HIGHOut-of-bounds write when processing 6LoWPAN extension headersEPSS 1.1%