CVE-2023-33974
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
RIOT-OS, an operating system for IoT devices, contains a network stack capable of processing 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device, triggering a race condition that leads to invalid memory access and denial of service.
Risk Assessment
This vulnerability can lead to significant disruptions in the operation of IoT devices, potentially affecting the availability of services within the organization.
Recommendation
It is recommended to update to RIOT-OS versions after 2023.01 to mitigate this vulnerability. There are no known workarounds.
Other vulnerabilities in RIOT-OS network stack
See all- CVE-2023-33975Critical
RIOT-OS, an operating system for IoT devices, contains a network stack capable of processing 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer.
- CVE-2023-33973High
RIOT-OS, an operating system for IoT devices, contains a network stack capable of processing 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send a crafted frame, leading to a NULL pointer dereference and crashing the device, resulting in denial of service.
Original NVD description (English source)
RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device to trigger a race condition. The race condition invalidates assumptions about the program state and leads to an invalid memory access resulting in denial of service. This issue is patched in pull request 19679. There are no known workarounds.