Contiki-NG up to 4.8 L2CAP ble-l2cap.c get_channel_for_cid out-of-bounds write

Summaryinfo

A vulnerability was found in Contiki-NG up to 4.8 and classified as critical. Affected by this issue is the function get_channel_for_cid of the file os/net/mac/ble/ble-l2cap.c of the component L2CAP Handler. Such manipulation leads to out-of-bounds write. This vulnerability is traded as CVE-2022-41873. Access to the local network is required for this attack to succeed. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Contiki-NG up to 4.8. It has been rated as critical. Affected by this issue is the function get_channel_for_cid of the file os/net/mac/ble/ble-l2cap.c of the component L2CAP Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 are vulnerable to an Out-of-bounds read. While processing the L2CAP protocol, the Bluetooth Low Energy stack of Contiki-NG needs to map an incoming channel ID to its metadata structure. While looking up the corresponding channel structure in get_channel_for_cid (in os/net/mac/ble/ble-l2cap.c), a bounds check is performed on the incoming channel ID, which is meant to ensure that the channel ID does not exceed the maximum number of supported channels.However, an integer truncation issue leads to only the lowest byte of the channel ID to be checked, which leads to an incomplete out-of-bounds check. A crafted channel ID leads to out-of-bounds memory to be read and written with attacker-controlled data. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. As a workaround, Users can apply the patch in Contiki-NG pull request 2081 on GitHub.

The weakness was shared 11/11/2022 as GHSA-m5cj-fw8m-ffgf. The advisory is available at github.com. This vulnerability is handled as CVE-2022-41873 since 09/30/2022. Technical details are known, but there is no available exploit.

Upgrading to version 4.9 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Contiki-NG

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8

License

• open-source

Website

• Product: https://github.com/contiki-ng/contiki-ng/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion