ID
VAR-202402-2171
CVE
CVE-2023-50926
TITLE
Contiki-NG Out-of-bounds read vulnerability in
Trust: 0.8
DESCRIPTION
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message contains a field that specifies the length of an IPv6 address prefix. The value of this field is not validated, which means that an attacker can set a value that is longer than the maximum prefix length. Subsequently, a memcmp function call that compares different prefixes can be called with a length argument that surpasses the boundary of the array allocated for the prefix, causing an out-of-bounds read. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in the next release. Users are advised to update as soon as they are able to or to manually apply the changes in Contiki-NG pull request #2721. Contiki-NG Exists in an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be in a state
Trust: 1.71
AFFECTED PRODUCTS
| vendor: | contiki ng | model: | contiki-ng | scope: | lte | version: | 4.9 | Trust: 1.0 |
| vendor: | contiki ng | model: | contiki-ng | scope: | - | version: | - | Trust: 0.8 |
| vendor: | contiki ng | model: | contiki-ng | scope: | lte | version: | 4.9 and earlier | Trust: 0.8 |
| vendor: | contiki ng | model: | contiki-ng | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-125 | Trust: 1.0 |
| problemtype: | Out-of-bounds read (CWE-125) [ others ] | Trust: 0.8 |
| problemtype: | Out-of-bounds read (CWE-125) [NVD evaluation ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2023-50926 | Trust: 2.7 |
| db: | JVNDB | id: | JVNDB-2023-027741 | Trust: 0.8 |
| db: | VULMON | id: | CVE-2023-50926 | Trust: 0.1 |
REFERENCES
| url: | https://github.com/contiki-ng/contiki-ng/security/advisories/ghsa-jp4p-fq85-jch2 | Trust: 1.9 |
| url: | https://github.com/contiki-ng/contiki-ng/pull/2721 | Trust: 1.9 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2023-50926 | Trust: 0.8 |
| url: | https://cwe.mitre.org/data/definitions/125.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULMON | id: | CVE-2023-50926 |
| db: | JVNDB | id: | JVNDB-2023-027741 |
| db: | NVD | id: | CVE-2023-50926 |
LAST UPDATE DATE
2025-01-08T22:53:17.104000+00:00
SOURCES UPDATE DATE
| db: | VULMON | id: | CVE-2023-50926 | date: | 2024-02-15T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-027741 | date: | 2025-01-07T01:36:00 |
| db: | NVD | id: | CVE-2023-50926 | date: | 2025-01-06T15:30:54.840 |
SOURCES RELEASE DATE
| db: | VULMON | id: | CVE-2023-50926 | date: | 2024-02-14T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-027741 | date: | 2025-01-07T00:00:00 |
| db: | NVD | id: | CVE-2023-50926 | date: | 2024-02-14T20:15:45.163 |