Scepticz

**Name of the Vulnerable Software and Affected Versions** Contiki-NG (affected versions not specified) **Description** The Contiki-NG operating system has an issue with its IPv6 implementation, specifically in the processing of source routing headers (SRH) in its two alternative RPL protocol implementations. This can lead to uncontrolled recursion in the `tcpip ipv6 output` function when receiving a packet with a next-hop address that is a local address, potentially causing a stack overflow. Attackers who can send IPv6 packets to the Contiki-NG host can trigger this issue. There are no known workarounds for this issue. **Recommendations** To resolve the issue, users are advised to either apply the patch manually from Contiki-NG pull request #2264 or wait for the next release of Contiki-NG, which is expected to include the fix. As a temporary workaround, consider restricting access to the `tcpip ipv6 output` function in the os/net/ipv6/tcpip.c module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Contiki-NG (affected versions not specified) **Description** An out-of-bounds write exists in the driver for IEEE 802.15.4 radios on nRF platforms in the Contiki-NG operating system. The issue is triggered when parsing radio frames in the `read frame` function in the `arch/cpu/nrf/net/nrf-ieee-driver-arch.c` module. The `read frame` function performs an incomplete validation of the payload length of the packet, which can be set by an external party. Although the value is validated to be in the range of the MTU length, it is not validated to fit into the given buffer into which the packet will be copied. **Recommendations** As a temporary workaround, consider manually applying the changes in PR #2741 until a patch is available. Update the develop branch or update to a subsequent release when available to resolve the issue. Users unable to upgrade should consider applying the above workaround to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Zephyr (affected versions not specified) **Description** The issue is related to a Bluetooth protocol implementation flaw in the Zephyr real-time operating system, involving the use of memory after it has been freed. This could allow a remote attacker to cause a denial of service or potentially execute arbitrary code. The bluetooth HCI host layer logic fails to clear a global reference to a state pointer after handling connection events, which may enable a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash or potential remote code execution on the Host layer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zephyr (affected versions not specified) **Description** The issue allows any malicious Bluetooth controller to execute arbitrary code on the Zephyr host due to union variant confusion. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RIOT-OS versions 2023.01 and prior **Description** The issue is related to a 6LoWPAN frame handler in the RIOT operating system kernel, which is connected to pointer dereference errors. An attacker can exploit this issue by sending multiple crafted frames to the device, triggering a race condition that leads to an invalid memory access and results in a denial of service. **Recommendations** For versions 2023.01 and prior, update to a version that includes the patch from pull request 19679 to resolve the issue. As a temporary workaround, consider restricting access to the network stack to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Contiki-NG versions 4.8 and prior **Description** The issue arises from the message handling code for IPv6 router solicitations in Contiki-NG, which contains an implementation of IPv6 Neighbor Discovery (ND) in the module `os/net/ipv6/uip-nd6.c`. The ND protocol includes a message type called Router Solicitation (RS), used to locate routers and update their address information via the SLLAO (Source Link-Layer Address Option). If the indicated source address changes, a given neighbor entry is set to the STALE state. The message handler does not check for RS messages with an SLLAO that indicates a link-layer address change, leading to the dereference of a NULL pointer of type `uip ds6 nbr t`. **Recommendations** For Contiki-NG versions 4.8 and prior, apply Contiki-NG pull request #2271 to patch the problem directly as a workaround. The problem has been patched in the `develop` branch of Contiki-NG, and will be included in the upcoming 4.9 release.

**Name of the Vulnerable Software and Affected Versions** RIOT-OS versions prior to 2022.10 **Description** The issue arises from a type confusion between IPv6 extension headers and a UDP header while encoding a 6LoWPAN IPHC header in the network stack. This type confusion results in an out of bounds write in the packet buffer, potentially leading to denial of service by corrupting other packets and the allocator metadata. Furthermore, an attacker can manipulate the allocator metadata to write data to arbitrary locations, thus enabling the execution of arbitrary code. **Recommendations** For versions prior to 2022.10, update to version 2022.10 to resolve the issue. As a temporary workaround for versions prior to 2022.10, apply the patches manually.

**Name of the Vulnerable Software and Affected Versions** RIOT-OS versions prior to 2022.10 **Description** The issue concerns a network stack in RIOT-OS, an operating system for Internet of Things devices, which can process 6LoWPAN frames. An attacker can send a crafted frame, resulting in a large out of bounds write beyond the packet buffer. This write creates a hard fault exception after reaching the last page of RAM, and since the hard fault is not handled, the system becomes stuck until reset, leading to a denial of service. **Recommendations** For versions prior to 2022.10, update to version 2022.10 to resolve the issue. As a temporary workaround, consider disabling support for fragmented IP datagrams until the update is applied. Alternatively, apply the patches manually to fix the issue.

**Name of the Vulnerable Software and Affected Versions** Contiki-NG versions 4.8 and prior **Description** Contiki-NG is an open-source, cross-platform operating system for internet of things (IoT) devices. In the affected versions, an out-of-bounds write can occur in the BLE L2CAP module of the Contiki-NG operating system. The network stack of Contiki-NG uses a global buffer (packetbuf) for processing of packets, with the size of `PACKETBUF SIZE`. When using the BLE L2CAP module with the default configuration, the `PACKETBUF SIZE` value becomes larger than the actual size of the packetbuf. When large packets are processed by the L2CAP module, a buffer overflow can occur when copying the packet data to the packetbuf. **Recommendations** For Contiki-NG versions 4.8 and prior, the problem can be worked around by applying the patch manually. As a temporary workaround, consider disabling the BLE L2CAP module until a patch is available. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9.

**Name of the Vulnerable Software and Affected Versions** Contiki-NG versions prior to and including 4.8 **Description** The issue concerns an out-of-bounds write in the BLE-L2CAP module of Contiki-NG, an open-source operating system for IoT devices. This module handles packet fragmentation up to the configured MTU size. When fragments are reassembled, they are stored in a packet buffer without verifying if the buffer is large enough, potentially leading to an out-of-bounds write of up to 1152 bytes in the default configuration. **Recommendations** For versions prior to and including 4.8, apply the patch in Contiki-NG pull request #2254 to fix the issue. As a temporary workaround, consider restricting the use of the BLE-L2CAP module until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Contiki-NG versions prior to 4.9 **Description** The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack that is vulnerable to a NULL Pointer Dereference in the BLE L2CAP module. An attacker can inject a packet into this stack, causing the implementation to dereference a NULL pointer and trigger undefined behavior. This occurs while processing the L2CAP protocol, where the implementation maps an incoming channel ID to its metadata structure. The `input l2cap credit` function in the `os/net/mac/ble/ble-l2cap.c` module manages state information regarding credits but does not check if the metadata corresponding to the user-supplied channel ID exists, potentially leading to a NULL pointer dereference. **Recommendations** For Contiki-NG versions prior to 4.9, apply the patch in Contiki-NG pull request #2253 as a workaround until the new package is released. As a temporary workaround, consider restricting access to the BLE L2CAP module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Contiki-NG versions prior to 4.9 **Description** The issue concerns an out-of-bounds read in Contiki-NG, an open-source operating system for IoT devices. It occurs while processing the L2CAP protocol in the Bluetooth Low Energy stack, where an integer truncation issue leads to an incomplete bounds check on incoming channel IDs. This allows a crafted channel ID to read and write out-of-bounds memory with attacker-controlled data. The vulnerability is related to the `get channel for cid` function in `os/net/mac/ble/ble-l2cap.c`. **Recommendations** For versions prior to 4.9, apply the patch in Contiki-NG pull request 2081 on GitHub as a workaround until the official release 4.9 is available.