Contiki-NG up to 4.9 SNMP snmp-ber.c snmp_ber_decode_string_len_buffer out-of-bounds

Summaryinfo

A vulnerability labeled as problematic has been found in Contiki-NG up to 4.9. This issue affects the function snmp_ber_decode_string_len_buffer of the file os/net/app-layer/snmp/snmp-ber.c of the component SNMP Module. Such manipulation leads to out-of-bounds. This vulnerability is listed as CVE-2024-41125. The attack must be carried out from within the local network. There is no available exploit. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Contiki-NG up to 4.9 and classified as critical. Affected by this issue is the function snmp_ber_decode_string_len_buffer of the file os/net/app-layer/snmp/snmp-ber.c of the component SNMP Module. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The vulnerability exists in the os/net/app-layer/snmp/snmp-ber.c module, where the function snmp_ber_decode_string_len_buffer decodes the string length from a received SNMP packet. In one place, one byte is read from the buffer, without checking that the buffer has another byte available, leading to a possible out-of-bounds read. The problem has been patched in Contiki-NG pull request #2936. It will be included in the next release of Contiki-NG. Users are advised to apply the patch manually or to wait for the next release. A workaround is to disable the SNMP module in the Contiki-NG build configuration.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-41125 since 07/15/2024. The exploitation is known to be difficult. The attack needs to be done within the local network. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Contiki-NG

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9

License

• open-source

Website

• Product: https://github.com/contiki-ng/contiki-ng/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion