CVE-2023-34100 Out-of-Bounds Read in contiki-ng

High 7.3 Published 9 Jun 2023 Updated 6 Jan 2025

An out-of-bounds read in Contiki-NG's TCP MSS handling allows attackers to read memory or cause crashes on IoT devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-34100?

CVE-2023-34100 is a high-severity memory corruption vulnerability in contiki-ng, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet, the Contiki-NG OS does not verify that certain buffer indices to read from are within the bounds of the IPv6 packet buffer, uip_buf. In particular, there is a 2-byte buffer read in the module os/net/ipv6/uip6.c. The buffer is indexed using 'UIP_IPTCPH_LEN + 2 + c' and 'UIP_IPTCPH_LEN + 3 + c', but the uip_buf buffer may not have enough data, resulting in a 2-byte read out of bounds. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in release 4.9. Users are advised to watch for the 4.9 release and to upgrade when it becomes available. There are no workarounds for this vulnerability aside from manually patching with the diff in commit `cde4e9839`.

Weakness: CWE-125

Which versions are affected by CVE-2023-34100?

It affects 1 product.

Products include Contiki-Ng Contiki-Ng.

How do I fix CVE-2023-34100?

No fix has been published for CVE-2023-34100 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-34100 being exploited?

There is no known exploitation of CVE-2023-34100 in the wild and no public exploit code.

Sources

Also known as GHSA-3v7c-jq9x-cmph.