CVE-2023-33974 HIGH

CVE-2023-33974: RIOT-OS vulnerable to Race Condition in SFR Timeout

Vendor Riot-Os
Product RIOT
Weakness CWE-362
Published May 30, 2023
Last update January 10, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device to trigger a race condition. The race condition invalidates assumptions about the program state and leads to an invalid memory access resulting in denial of service. This issue is patched in pull request 19679. There are no known workarounds.

Key dates

02Disclosure timeline

May 30, 2023 CVE published
January 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-31824 Sylius has a Promotion Usage Limit Bypass via Race Condition CVE-2026-23735 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modules CVE-2026-54229 Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking CVE-2025-59196 Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability CVE-2026-5947 SIG(0) validation during query flood may lead to undefined behavior