ID
VAR-202305-0517
CVE
CVE-2023-31129
TITLE
Contiki-NG In NULL Pointer dereference vulnerability
Trust: 0.8
DESCRIPTION
The Contiki-NG operating system versions 4.8 and prior can be triggered to dereference a NULL pointer in the message handling code for IPv6 router solicitiations. Contiki-NG contains an implementation of IPv6 Neighbor Discovery (ND) in the module `os/net/ipv6/uip-nd6.c`. The ND protocol includes a message type called Router Solicitation (RS), which is used to locate routers and update their address information via the SLLAO (Source Link-Layer Address Option). If the indicated source address changes, a given neighbor entry is set to the STALE state. The message handler does not check for RS messages with an SLLAO that indicates a link-layer address change that a neighbor entry can actually be created for the indicated address. The resulting pointer is used without a check, leading to the dereference of a NULL pointer of type `uip_ds6_nbr_t`. The problem has been patched in the `develop` branch of Contiki-NG, and will be included in the upcoming 4.9 release. As a workaround, users can apply Contiki-NG pull request #2271 to patch the problem directly. Contiki-NG for, NULL There is a vulnerability in pointer dereference.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Contiki-NG is an open-source, cross-platform operating system for next-generation IoT (Internet of Things) devices
Trust: 2.25
AFFECTED PRODUCTS
| vendor: | contiki ng | model: | contiki-ng | scope: | lte | version: | 4.8 | Trust: 1.0 |
| vendor: | contiki ng | model: | contiki-ng | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | contiki ng | model: | contiki-ng | scope: | lte | version: | 4.8 and earlier | Trust: 0.8 |
| vendor: | contiki ng | model: | contiki-ng | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-476 | Trust: 1.0 |
| problemtype: | NULL Pointer dereference (CWE-476) [NVD evaluation ] | Trust: 0.8 |
TYPE
code problem
Trust: 0.6
PATCH
| title: | Contiki-NG Fixes for code issue vulnerabilities | url: | http://123.124.177.30/web/xxk/bdxqById.tag?id=236254 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2023-31129 | Trust: 3.3 |
| db: | JVNDB | id: | JVNDB-2023-010063 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202305-460 | Trust: 0.6 |
| db: | VULMON | id: | CVE-2023-31129 | Trust: 0.1 |
REFERENCES
| url: | https://github.com/contiki-ng/contiki-ng/pull/2271 | Trust: 2.5 |
| url: | https://github.com/contiki-ng/contiki-ng/security/advisories/ghsa-x29r-5qjg-75mq | Trust: 2.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2023-31129 | Trust: 0.8 |
| url: | https://cxsecurity.com/cveshow/cve-2023-31129/ | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/476.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULMON | id: | CVE-2023-31129 |
| db: | JVNDB | id: | JVNDB-2023-010063 |
| db: | CNNVD | id: | CNNVD-202305-460 |
| db: | NVD | id: | CVE-2023-31129 |
LAST UPDATE DATE
2024-08-14T14:24:05.887000+00:00
SOURCES UPDATE DATE
| db: | VULMON | id: | CVE-2023-31129 | date: | 2023-05-09T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-010063 | date: | 2023-12-07T07:24:00 |
| db: | CNNVD | id: | CNNVD-202305-460 | date: | 2023-05-15T00:00:00 |
| db: | NVD | id: | CVE-2023-31129 | date: | 2023-05-15T18:05:51.943 |
SOURCES RELEASE DATE
| db: | VULMON | id: | CVE-2023-31129 | date: | 2023-05-08T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-010063 | date: | 2023-12-07T00:00:00 |
| db: | CNNVD | id: | CNNVD-202305-460 | date: | 2023-05-08T00:00:00 |
| db: | NVD | id: | CVE-2023-31129 | date: | 2023-05-08T21:15:11.513 |