CVE-2022-36053

{"id": "CVE-2022-36053", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}]}, "published": "2022-09-01T12:15:10.313", "references": [{"url": "https://github.com/contiki-ng/contiki-ng/pull/1648", "tags": ["Broken Link"], "source": "security-advisories@github.com"}, {"url": "https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-2j9c-7754-w4cw", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The low-power IPv6 network stack of Contiki-NG has a buffer module (os/net/ipv6/uipbuf.c) that processes IPv6 extension headers in incoming data packets. As part of this processing, the function uipbuf_get_next_header casts a pointer to a uip_ext_hdr structure into the packet buffer at different offsets where extension headers are expected to be found, and then reads from this structure. Because of a lack of bounds checking, the casting can be done so that the structure extends beyond the packet's end. Hence, with a carefully crafted packet, it is possible to cause the Contiki-NG system to read data outside the packet buffer. A patch that fixes the vulnerability is included in Contiki-NG 4.8."}, {"lang": "es", "value": "Contiki-NG es un sistema operativo de c\u00f3digo abierto y multiplataforma para dispositivos IoT de Pr\u00f3xima Generaci\u00f3n. La pila de red IPv6 de bajo consumo de Contiki-NG presenta un m\u00f3dulo de b\u00fafer (os/net/ipv6/uipbuf.c) que procesa los encabezados de extensi\u00f3n IPv6 en los paquetes de datos entrantes. Como parte de este procesamiento, la funci\u00f3n uipbuf_get_next_header lanza un puntero a una estructura uip_ext_hdr en el b\u00fafer del paquete en los diferentes desplazamientos en los que es esperado encontrar las cabeceras de extensi\u00f3n, y luego lee de esta estructura. Debido a una falta de comprobaci\u00f3n de l\u00edmites, el casting puede hacerse de manera que la estructura sea extendida m\u00e1s all\u00e1 del final del paquete. Por lo tanto, con un paquete cuidadosamente dise\u00f1ado, es posible causar que el sistema Contiki-NG lea datos fuera del buffer del paquete. En Contiki-NG versi\u00f3n 4.8 es incluido un parche que corrige la vulnerabilidad"}], "lastModified": "2022-09-07T15:31:04.607", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8753C87C-46B4-467B-9598-30E562D5CB38", "versionEndExcluding": "4.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}