CVE-2023-24818: RIOT-OS vulnerable to null pointer dereference during fragment forwarding
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference. During forwarding of a fragment an uninitialized entry in the reassembly buffer is used. The NULL pointer dereference triggers a hard fault exception resulting in denial of service. Version 2022.10 fixes this issue. As a workaround, disable support for fragmented IP datagrams or apply the patches manually.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24818?
CVE-2023-24818 is classified as a medium severity vulnerability due to its potential impact on device stability and operation.
How do I fix CVE-2023-24818?
To fix CVE-2023-24818, upgrade to Riot-OS version 2022.10 or later.
What can an attacker do with CVE-2023-24818?
An attacker can exploit CVE-2023-24818 by sending a crafted 6LoWPAN frame, leading to a NULL pointer dereference and potential device instability.
Which versions of Riot-OS are affected by CVE-2023-24818?
Riot-OS versions prior to 2022.10 are affected by CVE-2023-24818.
Is CVE-2023-24818 related to IoT security?
Yes, CVE-2023-24818 impacts the security and stability of Internet of Things devices running the affected versions of Riot-OS.