CVE-2023-34100
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Contiki-NG, an operating system for IoT devices, has a vulnerability that allows reading data out of bounds of the IPv6 buffer when processing the MSS option in TCP packets. The issue involves buffer indexing in the module os/net/ipv6/uip6.c, which may lead to unauthorized memory access.
Risk Assessment
This vulnerability could lead to system crashes or allow an attacker to execute malicious code, posing a serious security threat to IoT devices running Contiki-NG.
Recommendation
It is recommended to upgrade to version 4.9 of Contiki-NG when it becomes available to mitigate this vulnerability. Users may also manually apply the patch from commit `cde4e9839` as a temporary solution.
Other vulnerabilities in Contiki-NG
See all- CVE-2026-5857High
Contiki-NG's MQTT client in parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, the parser skips the length-reading block and performs a memcpy with an unvalidated length, leading to overflow of the topic[] buffer and overwriting adjacent fields, including the payload_chunk pointer. This can enable remote code execution on devices without memory protection.
- CVE-2026-5856High
Contiki-NG's DNS/mDNS resolver in skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() iterates nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker can set nquestions higher than the number of complete questions, causing out-of-bounds reads past the UDP packet buffer and disclosing memory contents or crashing the resolver.
- CVE-2026-5855High
Contiki-NG's LwM2M TLV parser in lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. A crafted CoAP WRITE with a final TLV supplying exactly one byte triggers up to five out-of-bounds reads of heap memory, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.
- CVE-2023-34101High
Contiki-NG is an operating system for IoT devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` function, the system does not verify that the packet buffer is large enough, which can lead to out-of-bounds reads.
Original NVD description (English source)
Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet, the Contiki-NG OS does not verify that certain buffer indices to read from are within the bounds of the IPv6 packet buffer, uip_buf. In particular, there is a 2-byte buffer read in the module os/net/ipv6/uip6.c. The buffer is indexed using 'UIP_IPTCPH_LEN + 2 + c' and 'UIP_IPTCPH_LEN + 3 + c', but the uip_buf buffer may not have enough data, resulting in a 2-byte read out of bounds. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in release 4.9. Users are advised to watch for the 4.9 release and to upgrade when it becomes available. There are no workarounds for this vulnerability aside from manually patching with the diff in commit `cde4e9839`.