CVE-2023-33975 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add

Critical 9.8 Published 30 May 2023 Updated 10 Jan 2025

An attacker can send crafted 6LoWPAN frames to RIOT-OS devices to trigger an out-of-bounds write, potentially leading to arbitrary code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-33975?

CVE-2023-33975 is a critical memory corruption vulnerability in RIOT-OS RIOT, published on 30 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. This issue is fixed in pull request 19680. As a workaround, disable support for fragmented IP datagrams.

Weakness: CWE-787, CWE-119

Which versions are affected by CVE-2023-33975?

It affects 1 product.

Products include Riot-Os Riot.

How do I fix CVE-2023-33975?

No fix has been published for CVE-2023-33975 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-33975 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33975 exists.

Sources

Also known as GHSA-f6ff-g7mh-58q4.