RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark
Priority HIGH 72CWE-252Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.
Summary
RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00956 61st percentileScored 2026-11-07
Fix Fixed RIOT (RIOT-OS): 2023.04
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA RIOT (RIOT-OS) Fixed in 2023.04
Timeline
- 2026-10-02 Threatist record created from CVE-2023-24825
References
Advisory 5
- https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xqm8-xj74-fjw2
- https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L416
- https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L429
- https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L729
- https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L169
More RIOT-OS Riot vulnerabilities
- TI-2024-21112 Buffer overflows in RIOT CVSS 3.1CRITICAL 9.8
- TI-2023-16843 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add CVSS 3.1CRITICAL 9.8
- TI-2023-10319 RIOT-OS vulnerable to Buffer Overflow during IPHC receive CVSS 3.1CRITICAL 9.8
- TI-2026-22079 RIOT has an Out-of-Bounds Write in nanoCoAP Handler CVSS 3.1CRITICAL 9.8
- TI-2023-16842 RIOT-OS vulnerable to Race Condition in SFR Timeout CVSS 3.1HIGH 7.5
- TI-2023-16841 RIOT-OS vulnerable to NULL pointer dereference during NHC encoding CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences