CVE-2023-24817: RIOT-OS vulnerable to Out of Bounds write in routing with SRH
RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer. Triggering the access at the right time will corrupt other packets or the allocator metadata. Corrupting a pointer will lead to denial of service. This issue is fixed in version 2023.04. As a workaround, disable SRH in the network stack.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24817?
CVE-2023-24817 has a severity rating that indicates a critical risk due to potential integer underflow and out of bounds access.
How do I fix CVE-2023-24817?
To mitigate CVE-2023-24817, upgrade to RIOT version 2023.04 or later.
What devices are affected by CVE-2023-24817?
CVE-2023-24817 affects all versions of RIOT-OS prior to 2023.04 that utilize the network stack for processing 6LoWPAN frames.
What type of exploit is possible with CVE-2023-24817?
CVE-2023-24817 can be exploited by sending a crafted frame to the device, leading to an integer underflow issue.
Is there a workaround for CVE-2023-24817 if I cannot upgrade?
Currently, there is no documented workaround for CVE-2023-24817, and upgrading is the recommended action.