ID
VAR-202209-0090
CVE
CVE-2022-36053
TITLE
Contiki-NG Out-of-bounds read vulnerability in
Trust: 0.8
DESCRIPTION
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The low-power IPv6 network stack of Contiki-NG has a buffer module (os/net/ipv6/uipbuf.c) that processes IPv6 extension headers in incoming data packets. As part of this processing, the function uipbuf_get_next_header casts a pointer to a uip_ext_hdr structure into the packet buffer at different offsets where extension headers are expected to be found, and then reads from this structure. Because of a lack of bounds checking, the casting can be done so that the structure extends beyond the packet's end. Hence, with a carefully crafted packet, it is possible to cause the Contiki-NG system to read data outside the packet buffer. A patch that fixes the vulnerability is included in Contiki-NG 4.8. Contiki-NG Exists in an out-of-bounds read vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
Trust: 2.25
AFFECTED PRODUCTS
| vendor: | contiki ng | model: | contiki-ng | scope: | lt | version: | 4.8 | Trust: 1.0 |
| vendor: | contiki ng | model: | contiki-ng | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | contiki ng | model: | contiki-ng | scope: | eq | version: | 4.8 | Trust: 0.8 |
| vendor: | contiki ng | model: | contiki-ng | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-125 | Trust: 1.0 |
| problemtype: | Out-of-bounds read (CWE-125) [ others ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
buffer error
Trust: 0.6
PATCH
| title: | Contiki-NG Buffer error vulnerability fix | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=206823 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2022-36053 | Trust: 3.3 |
| db: | JVNDB | id: | JVNDB-2022-016127 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202209-017 | Trust: 0.6 |
| db: | VULMON | id: | CVE-2022-36053 | Trust: 0.1 |
REFERENCES
| url: | https://github.com/contiki-ng/contiki-ng/security/advisories/ghsa-2j9c-7754-w4cw | Trust: 2.5 |
| url: | https://github.com/contiki-ng/contiki-ng/pull/1648 | Trust: 1.7 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2022-36053 | Trust: 0.8 |
| url: | https://cxsecurity.com/cveshow/cve-2022-36053/ | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/125.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULMON | id: | CVE-2022-36053 |
| db: | JVNDB | id: | JVNDB-2022-016127 |
| db: | CNNVD | id: | CNNVD-202209-017 |
| db: | NVD | id: | CVE-2022-36053 |
LAST UPDATE DATE
2024-08-14T14:24:35.840000+00:00
SOURCES UPDATE DATE
| db: | VULMON | id: | CVE-2022-36053 | date: | 2022-09-01T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-016127 | date: | 2023-10-02T08:10:00 |
| db: | CNNVD | id: | CNNVD-202209-017 | date: | 2022-09-08T00:00:00 |
| db: | NVD | id: | CVE-2022-36053 | date: | 2022-09-07T15:31:04.607 |
SOURCES RELEASE DATE
| db: | VULMON | id: | CVE-2022-36053 | date: | 2022-09-01T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-016127 | date: | 2023-10-02T00:00:00 |
| db: | CNNVD | id: | CNNVD-202209-017 | date: | 2022-09-01T00:00:00 |
| db: | NVD | id: | CVE-2022-36053 | date: | 2022-09-01T12:15:10.313 |