CVE-2023-24825 HIGH

CVE-2023-24825: RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark

Vendor Riot-Os
Product RIOT
Weakness CWE-252
Published May 30, 2023
Last update January 10, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.

Key dates

02Disclosure timeline

May 30, 2023 CVE published
January 10, 2025 Record updated