CVE-2024-52802 RIOT-OS missing dhcpv6_opt_t minimum header length check
Attackers can cause system inconsistency and denial of service in RIOT-OS IoT devices via out-of-bound reads in DHCPv6 parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-52802?
CVE-2024-52802 is a high-severity denial of service vulnerability in RIOT-OS RIOT, published on 22 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in `/sys/net/application_layer/dhcpv6/client.c`, has no minimum header length check for `dhcpv6_opt_t` after processing `dhcpv6_msg_t`. This omission could lead to an out-of-bound read, causing system inconsistency. Additionally, the same lack of a header length check is present in the function `_preparse_advertise`, which is called by `_parse_advertise` before handling the request. As of time of publication, no known patched version exists.
Which versions are affected by CVE-2024-52802?
It affects 1 product.
Products include Riot-Os Riot.
How do I fix CVE-2024-52802?
No fix has been published for CVE-2024-52802 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-52802 being exploited?
There is no known exploitation of CVE-2024-52802 in the wild and no public exploit code.
Other vulnerabilities in RIOT-OS RIOT
Sources
Also known as GHSA-xgv3-pcq6-qmrg.