CVE-2023-48229

Summary

CVE-2023-48229 is a vulnerability affecting the Contiki-NG operating system for IoT devices. The issue lies in the IEEE 802.15.4 radio driver on nRF platforms, where an out-of-bounds write occurs during packet parsing in the `read_frame` function. This vulnerability is triggered when processing radio frames with maliciously crafted payload lengths, which may exceed the buffer size. The `read_frame` function fails to validate the payload length thoroughly, leading to an out-of-bounds write. The vulnerability has been addressed in the "develop" branch and is scheduled for inclusion in future Contiki-NG releases. Users are encouraged to upgrade or apply the patch in PR #2741 as a temporary measure.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.