CVE-2023-37459

Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify that a full TCP header has been received. Specifically, the implementation attempts to access the flags field from the TCP buffer in the following conditional expression in the `check_for_tcp_syn` function. For this reason, an attacker can inject a truncated TCP packet, which will lead to an out-of-bound read from the packet buffer. As of time of publication, a patched version is not available. As a workaround, one can apply the changes in Contiki-NG pull request #2510 to patch the system.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/contiki-ng/contiki-ng/pull/2510	Issue Tracking Patch
https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-6648-m23r-hq8c	Vendor Advisory
https://github.com/contiki-ng/contiki-ng/pull/2510	Issue Tracking Patch
https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-6648-m23r-hq8c	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:11

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-15 20:15

Updated : 2024-11-21 08:11

NVD link : CVE-2023-37459

Mitre link : CVE-2023-37459

CVE.ORG link : CVE-2023-37459

JSON object : View

Products Affected

contiki-ng

contiki-ng

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2023-37459", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-09-15T20:15:08.650", "references": [{"url": "https://github.com/contiki-ng/contiki-ng/pull/2510", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-6648-m23r-hq8c", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/contiki-ng/contiki-ng/pull/2510", "tags": ["Issue Tracking", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-6648-m23r-hq8c", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify that a full TCP header has been received. Specifically, the implementation attempts to access the flags field from the TCP buffer in the following conditional expression in the `check_for_tcp_syn` function. For this reason, an attacker can inject a truncated TCP packet, which will lead to an out-of-bound read from the packet buffer. As of time of publication, a patched version is not available. As a workaround, one can apply the changes in Contiki-NG pull request #2510 to patch the system."}, {"lang": "es", "value": "Contiki-NG es un sistema operativo para dispositivos de Internet de las cosas. En las versiones 4.9 y anteriores, cuando se recibe un paquete, la pila de red Contiki-NG intenta iniciar el temporizador TCP peri\u00f3dico si se trata de un paquete TCP con el indicador SYN configurado. Pero la implementaci\u00f3n no verifica primero que se haya recibido un encabezado TCP completo. Espec\u00edficamente, la implementaci\u00f3n intenta acceder al campo de banderas desde el b\u00fafer TCP en la siguiente expresi\u00f3n condicional en la funci\u00f3n `check_for_tcp_syn`. Por este motivo, un atacante puede inyectar un paquete TCP truncado, lo que provocar\u00e1 una lectura fuera de los l\u00edmites del b\u00fafer de paquetes. Al momento de la publicaci\u00f3n, no hay una versi\u00f3n parcheada disponible. Como workaround, se pueden aplicar los cambios en la solicitud de extracci\u00f3n #2510 de Contiki-NG para parchear el sistema."}], "lastModified": "2024-11-21T08:11:44.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5ECE789E-8C10-42CB-BD98-A301AC471904", "versionEndIncluding": "4.9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}