CVE-2021-21281: Buffer overflow due to unvalidated TCP data offset
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions prior to 4.6. After establishing a TCP socket using the tcp-socket library, it is possible for the remote end to send a packet with a data offset that is unvalidated. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaround.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-21281?
CVE-2021-21281 is a buffer overflow vulnerability in Contiki-NG, versions prior to 4.6, that allows for remote code execution.
How severe is CVE-2021-21281?
CVE-2021-21281 has a severity rating of 9.8 (Critical) out of 10.
Is Contiki-NG version 4.6 affected by CVE-2021-21281?
No, Contiki-NG version 4.6 is not affected by CVE-2021-21281.
How can I fix CVE-2021-21281?
To fix CVE-2021-21281, it is recommended to update Contiki-NG to version 4.6 or later.
Where can I find more information about CVE-2021-21281?
You can find more information about CVE-2021-21281 in the Contiki-NG GitHub repository and the associated security advisory.