CVE-2023-48229
CVSS 3.1 Score 7.6 of 10 (high)
Details
Summary
CVE-2023-48229 is a vulnerability affecting Contiki-NG, an open-source operating system for IoT devices. The issue lies in the IEEE 802.15.4 radio driver on nRF platforms, where an out-of-bounds write occurs in the `read_frame` function. This vulnerability is triggered when parsing radio frames, and it arises due to an incomplete validation of the payload length. Although the length is validated to be within the Maximum Transmission Unit (MTU) length, it is not checked if it fits into the given buffer. The problem has been patched in the Contiki-NG "develop" branch and is anticipated to be included in future releases. It is recommended that users update their Contiki-NG systems or manually apply the patch from PR #2741 to mitigate the risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Contiki-NG
Affected Vendors
- Adam Dunkels