Vulnerability · Published Jun 18, 2021 · Assigned by GitHub_M

CVE-2021-21410Out-of-bounds read in the 6LoWPAN implementation

High 8.2

In plain English

A high-severity out-of-bounds read in contiki-ng from contiki-ng. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)1.2%top 30.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function (<code>uncompress_hdr_iphc</code>) does not perform proper boundary checks when reading from the packet buffer. Hence, it is possible to construct a compressed 6LoWPAN packet that will read more bytes than what is available from the packet buffer. As of time of publication, there is not a release with a patch available. Users can apply the patch for this vulnerability out-of-band as a workaround.

Affected products (as reported)

Vendor	Product	Versions
contiki-ng	contiki-ng	<= 4.6

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

References

https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-hhwj-2p59-v8p9 x_refsource_CONFIRM
https://github.com/contiki-ng/contiki-ng/pull/1482 x_refsource_MISC