Vulnerabilities > CVE-2021-32771 - Unspecified vulnerability in Contiki-Ng

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

high complexity

contiki-ng

NVD

Published: 2022-08-04

Updated: 2024-11-21

Summary

Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have joined an RPL DODAG. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits. The problem was fixed after the release of Contiki-NG 4.7. Users unable to upgrade may apply the patch in Contiki-NG PR #1615.

Vulnerable Configurations

Part	Description	Count
OS	Contiki-Ng Contiki NG Contiki NG - Contiki NG Contiki NG 2.0 Contiki NG Contiki NG 2.1 Contiki NG Contiki NG 2.2 Contiki NG Contiki NG 2.2.1 Contiki NG Contiki NG 2.2.2 Contiki NG Contiki NG 2.2.3 Contiki NG Contiki NG 2.3 Contiki NG Contiki NG 2.4 Contiki NG Contiki NG 2.5 Contiki NG Contiki NG 2.6 Contiki NG Contiki NG 2.7 Contiki NG Contiki NG 3.0 Contiki NG Contiki NG 4.0 Contiki NG Contiki NG 4.1 Contiki NG Contiki NG 4.2 Contiki NG Contiki NG 4.3 Contiki NG Contiki NG 4.4 Contiki NG Contiki NG 4.5 Contiki NG Contiki NG 4.6 Contiki NG Contiki NG 4.7 Contiki NG Contiki NG 4.8	23

Summary

Vulnerable Configurations

References