TI-2023-10318 Aliases CVE-2023-24818

RIOT-OS vulnerable to null pointer dereference during fragment forwarding

HIGH 72CWE-476Published 2023-04-24 · Updated 2025-02-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference. During forwarding of a fragment an uninitialized entry in the reassembly buffer is used. The NULL pointer dereference triggers a hard fault exception resulting in denial of service. Version 2022.10 fixes this issue. As a workaround, disable support for fragmented IP datagrams or apply the patches manually.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01212 68th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed RIOT (RIOT-OS): 2022.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
RIOT-OS	RIOT	before 2022.10	2022.10	Patch available	CNA

RIOT VendorRIOT-OS Affected before 2022.10 Fixed in 2022.10 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:riot-os:riot::::::::	before 2022.10	Vulnerable	RIOT-OS

cpe:2.3:o:riot-os:riot:*:*:*:*:*:*:*:* Versions before 2022.10 Vulnerable ·RIOT-OS

Remediation

Fix · CNA RIOT (RIOT-OS) Fixed in 2022.10

Timeline

2026-10-02 Threatist record created from CVE-2023-24818

References

Exploit 1

https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-69h9-vj5r-xcg6

Patch 6

TI-2024-21112 Buffer overflows in RIOT CVSS 3.1CRITICAL 9.8
TI-2023-16843 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add CVSS 3.1CRITICAL 9.8
TI-2023-10319 RIOT-OS vulnerable to Buffer Overflow during IPHC receive CVSS 3.1CRITICAL 9.8
TI-2026-22079 RIOT has an Out-of-Bounds Write in nanoCoAP Handler CVSS 3.1CRITICAL 9.8
TI-2023-16842 RIOT-OS vulnerable to Race Condition in SFR Timeout CVSS 3.1HIGH 7.5
TI-2023-16841 RIOT-OS vulnerable to NULL pointer dereference during NHC encoding CVSS 3.1HIGH 7.5

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences