CVE-2024-52802CWE-125CWE-20

RIOT-OS missing dhcpv6_opt_t minimum header length check

High · published November 22, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in `/sys/net/application_layer/dhcpv6/client.c`, has no minimum header length check for `dhcpv6_opt_t` after processing `dhcpv6_msg_t`. This omission could lead to an out-of-bound read, causing system inconsistency. Additionally, the same lack of a header length check is present in the function `_preparse_advertise`, which is called by `_parse_advertise` before handling the request. As of time of publication, no known patched version exists.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00759 · 54.7th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-20 · Improper Input Validation
Published
2024-11-22T15:41Z
EPSS history
Timeline
  • 22 NOV 15:41Z
    RIOT-OS missing dhcpv6_opt_t minimum header length check
    cvelistv5