CVE-2022-36054 Out-of-bounds write when decompressing 6LoWPAN payload in Contiki-NG

Medium 6.8 Published 1 Sep 2022 Updated 23 Apr 2025

An attacker can trigger an out-of-bounds write in Contiki-NG by sending crafted 6LoWPAN packets, potentially leading to code execution or system crashes.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-36054?

CVE-2022-36054 is a medium-severity memory corruption vulnerability in contiki-ng, published on 1 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in the Contiki-NG operating system (file os/net/ipv6/sicslowpan.c) contains an input function that processes incoming packets and copies them into a packet buffer. Because of a missing length check in the input function, it is possible to write outside the packet buffer's boundary. The vulnerability can be exploited by anyone who has the possibility to send 6LoWPAN packets to a Contiki-NG system. In particular, the vulnerability is exposed when sending either of two types of 6LoWPAN packets: an unfragmented packet or the first fragment of a fragmented packet. If the packet is sufficiently large, a subsequent memory copy will cause an out-of-bounds write with data supplied by the attacker.

Weakness: CWE-787

Which versions are affected by CVE-2022-36054?

It affects 1 product.

Products include Contiki-Ng Contiki-Ng.

How do I fix CVE-2022-36054?

No fix has been published for CVE-2022-36054 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-36054 being exploited?

There is no known exploitation of CVE-2022-36054 in the wild and no public exploit code.

Sources

Also known as GHSA-c36p-vhwg-244c.