GHSA-jwmv-47p2-hgq2: RIOT-OS vulnerable to Packet Type Confusion during IPHC send
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a type confusion between IPv6 extension headers and a UDP header. This occurs while encoding a 6LoWPAN IPHC header. The type confusion manifests in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. Version 2022.10 fixes this issue. As a workaround, apply the patches manually.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RIOT-OSto a version that resolves this vulnerability.Fixed in 2022.10
Event History
Frequently Asked Questions
Which deployments are exposed?
RIOT-OS devices that process 6LoWPAN frames are exposed when running a version earlier than 2022.10. The issue is in the network stack's 6LoWPAN IPHC header encoding path.
What does an attacker need to exploit this issue?
An attacker needs to be able to send a crafted 6LoWPAN frame to the target device. No privileges or user interaction are required.
What can exploitation achieve?
The crafted frame causes an out-of-bounds write in the packet buffer, which can corrupt packets and allocator metadata. Pointer corruption can cause denial of service, while controlled allocator metadata corruption may allow arbitrary writes and code execution.
What should be done if upgrading is not immediately possible?
Apply the available patches manually. Version 2022.10 includes the fix.