RIOT-OS up to 2025.04 l2filter_add addr_len buffer overflow

Summaryinfo

A vulnerability described as critical has been identified in RIOT-OS up to 2025.04. Affected by this vulnerability is the function l2filter_add. Executing a manipulation of the argument addr_len can lead to buffer overflow. This vulnerability appears as CVE-2025-53888. The attack may be performed from remote. There is no available exploit. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in RIOT-OS up to 2025.04. It has been declared as critical. This vulnerability affects the function l2filter_add. The manipulation of the argument addr_len with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect availability. CVE summarizes:

RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with `assert()` can lead to buffer overflow in versions up to and including 2025.04. Assertions are usually compiled out in production builds. If assertions are the only defense against untrusted inputs, the software may be exposed to attacks that utilize the lack of proper input checks. In the `l2filter_add()` function shown below, `addr_len` is checked using an assertion and is subsequently used as an argument in a `memcpy()` call. When assertions are disabled, there would be no size check for `addr_len`. As a consequence, if an attacker were to provide an `addr_len` value larger than `CONFIG_L2FILTER_ADDR_MAXLEN`, they can trigger a buffer overflow and write past the `list[i].addr` buffer. If the unchecked input is attacker-controlled, the impact of the buffer overflow can range from a denial of service to arbitrary code execution. Commit f6f7de4ccc107c018630e4c15500825caf02e1c2 contains a patch for the vulnerability.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-53888 since 07/11/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Applying the patch f6f7de4ccc107c018630e4c15500825caf02e1c2 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• RIOT-OS

Version

• 2025.04

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion