Sign-up

ID

VAR-202106-0699


CVE

CVE-2021-21410


TITLE

Contiki-NG  Out-of-bounds read vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-008309

DESCRIPTION

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function (<code>uncompress_hdr_iphc</code>) does not perform proper boundary checks when reading from the packet buffer. Hence, it is possible to construct a compressed 6LoWPAN packet that will read more bytes than what is available from the packet buffer. As of time of publication, there is not a release with a patch available. Users can apply the patch for this vulnerability out-of-band as a workaround. Contiki-NG Is vulnerable to an out-of-bounds read.Information is obtained and denial of service (DoS) It may be put into a state. The 6LoWPAN implementation in Contiki-NG 4.6 and earlier versions has an out-of-bounds read vulnerability. No detailed vulnerability details are currently provided. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Contiki-NG has a buffer error vulnerability, which originates from the 6LoWPAN message of devices of 4.6 and above that will trigger a read out of range

Trust: 3.24

sources: NVD: CVE-2021-21410 // JVNDB: JVNDB-2021-008309 // CNVD: CNVD-2021-44273 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-1428

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-44273

AFFECTED PRODUCTS

vendor:contiki ngmodel:contiki-ngscope:lteversion:4.6

Trust: 1.0

vendor:contiki ngmodel:contiki-ngscope:eqversion: -

Trust: 0.8

vendor:contiki ngmodel:contiki-ngscope:lteversion:4.6 and earlier

Trust: 0.8

vendor:contiki ngmodel:contiki-ngscope:ltversion:4.6

Trust: 0.6

sources: CNVD: CNVD-2021-44273 // JVNDB: JVNDB-2021-008309 // NVD: CVE-2021-21410

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-21410
value: CRITICAL

Trust: 1.0

security-advisories@github.com: CVE-2021-21410
value: HIGH

Trust: 1.0

NVD: CVE-2021-21410
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2021-44273
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202106-1428
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2021-21410
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2021-44273
severity: HIGH
baseScore: 8.5
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 7.8
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-21410
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.2
version: 3.1

Trust: 1.0

security-advisories@github.com: CVE-2021-21410
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 4.2
version: 3.1

Trust: 1.0

NVD: CVE-2021-21410
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-44273 // JVNDB: JVNDB-2021-008309 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-1428 // NVD: CVE-2021-21410 // NVD: CVE-2021-21410

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

problemtype:Out-of-bounds read (CWE-125) [ Other ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-008309 // NVD: CVE-2021-21410

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202106-1428

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:Added buffer boundary checks for 6LoWPAN decompression #1482 GitHuburl:https://github.com/contiki-ng/contiki-ng/pull/1482

Trust: 0.8

title:Patch for Contiki-NG out-of-bounds read vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/274526

Trust: 0.6

title:Contiki-NG Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=155318

Trust: 0.6

sources: CNVD: CNVD-2021-44273 // JVNDB: JVNDB-2021-008309 // CNNVD: CNNVD-202106-1428

EXTERNAL IDS

db:NVDid:CVE-2021-21410

Trust: 3.8

db:JVNDBid:JVNDB-2021-008309

Trust: 0.8

db:CNVDid:CNVD-2021-44273

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021062409

Trust: 0.6

db:CNNVDid:CNNVD-202106-1428

Trust: 0.6

sources: CNVD: CNVD-2021-44273 // JVNDB: JVNDB-2021-008309 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-1428 // NVD: CVE-2021-21410

REFERENCES

url:https://github.com/contiki-ng/contiki-ng/security/advisories/ghsa-hhwj-2p59-v8p9

Trust: 1.6

url:https://github.com/contiki-ng/contiki-ng/pull/1482

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-21410

Trust: 1.4

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021062409

Trust: 0.6

sources: CNVD: CNVD-2021-44273 // JVNDB: JVNDB-2021-008309 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-1428 // NVD: CVE-2021-21410

SOURCES

db:CNVDid:CNVD-2021-44273
db:JVNDBid:JVNDB-2021-008309
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202106-1428
db:NVDid:CVE-2021-21410

LAST UPDATE DATE

2024-08-14T12:52:48.604000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-44273date:2021-06-23T00:00:00
db:JVNDBid:JVNDB-2021-008309date:2022-03-11T08:51:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202106-1428date:2021-06-28T00:00:00
db:NVDid:CVE-2021-21410date:2021-06-24T19:27:44.063

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-44273date:2021-06-23T00:00:00
db:JVNDBid:JVNDB-2021-008309date:2022-03-11T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202106-1428date:2021-06-18T00:00:00
db:NVDid:CVE-2021-21410date:2021-06-18T21:15:07.947