GHSA-xqm8-xj74-fjw2: RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark

Q: Which deployments are exposed to this issue?

RIOT-OS deployments that process 6LoWPAN frames are exposed if they run a version earlier than 2023.04. The issue affects the RIOT-OS network stack.

Q: What does an attacker need to exploit it?

An attacker only needs to send a crafted 6LoWPAN frame to the target device. No privileges or user interaction are required.

Q: What is the impact of successful exploitation?

A crafted frame can trigger a NULL pointer dereference in gnrc_pktbuf_mark, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.

Q: How can this be remediated if a device is affected?

Update RIOT-OS to version 2023.04 or later. There are no known workarounds if patching cannot be performed immediately.

Published May 30, 2023

Updated

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.

Affected Software

1 affected component

RIOT-OS RIOT-OS<2023.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade RIOT-OS to a version that resolves this vulnerability.
Fixed in 2023.04

Event History

May 30, 2023

CVE Published

via OSV·03:54 PM

Data Sourced

via OSV·03:54 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

RIOT-OS deployments that process 6LoWPAN frames are exposed if they run a version earlier than 2023.04. The issue affects the RIOT-OS network stack.

What does an attacker need to exploit it?

An attacker only needs to send a crafted 6LoWPAN frame to the target device. No privileges or user interaction are required.

What is the impact of successful exploitation?

A crafted frame can trigger a NULL pointer dereference in gnrc_pktbuf_mark, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.

How can this be remediated if a device is affected?

Update RIOT-OS to version 2023.04 or later. There are no known workarounds if patching cannot be performed immediately.

GHSA-xqm8-xj74-fjw2: RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can this be remediated if a device is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can this be remediated if a device is affected?