CVE-2022-35927 Unverified DIO prefix info lengths in RPL-Classic in Contiki-NG
An attacker can trigger a buffer overflow in Contiki-NG's RPL-Classic implementation by sending malformed DIO messages, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-35927?
CVE-2022-35927 is a high-severity memory corruption vulnerability in contiki-ng, published on 4 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating system, an incoming DODAG Information Option (DIO) control message can contain a prefix information option with a length parameter. The value of the length parameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_from_prefix function. This vulnerability affects anyone running a Contiki-NG version prior to 4.7 that can receive RPL DIO messages from external parties. To obtain a patched version, users should upgrade to Contiki-NG 4.7 or later. There are no workarounds for this issue.
Weakness: CWE-120
Which versions are affected by CVE-2022-35927?
It affects 1 product.
Products include Contiki-Ng Contiki-Ng.
How do I fix CVE-2022-35927?
No fix has been published for CVE-2022-35927 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-35927 being exploited?
There is no known exploitation of CVE-2022-35927 in the wild and no public exploit code.
Other vulnerabilities in contiki-ng
Sources
Also known as GHSA-9rm9-3phh-p4wm.