Vulnerability Details CVE-2021-21410
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function (<code>uncompress_hdr_iphc</code>) does not perform proper boundary checks when reading from the packet buffer. Hence, it is possible to construct a compressed 6LoWPAN packet that will read more bytes than what is available from the packet buffer. As of time of publication, there is not a release with a patch available. Users can apply the patch for this vulnerability out-of-band as a workaround.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 62.0%
CVSS Severity
CVSS v3 Score 8.2
CVSS v2 Score 6.4
References
Products affected by CVE-2021-21410
-
cpe:2.3:o:contiki-ng:contiki-ng:-
-
cpe:2.3:o:contiki-ng:contiki-ng:2.0
-
cpe:2.3:o:contiki-ng:contiki-ng:2.1
-
cpe:2.3:o:contiki-ng:contiki-ng:2.2
-
cpe:2.3:o:contiki-ng:contiki-ng:2.2.1
-
cpe:2.3:o:contiki-ng:contiki-ng:2.2.2
-
cpe:2.3:o:contiki-ng:contiki-ng:2.2.3
-
cpe:2.3:o:contiki-ng:contiki-ng:2.3
-
cpe:2.3:o:contiki-ng:contiki-ng:2.4
-
cpe:2.3:o:contiki-ng:contiki-ng:2.5
-
cpe:2.3:o:contiki-ng:contiki-ng:2.6
-
cpe:2.3:o:contiki-ng:contiki-ng:2.7
-
cpe:2.3:o:contiki-ng:contiki-ng:3.0
-
cpe:2.3:o:contiki-ng:contiki-ng:4.0
-
cpe:2.3:o:contiki-ng:contiki-ng:4.1
-
cpe:2.3:o:contiki-ng:contiki-ng:4.2
-
cpe:2.3:o:contiki-ng:contiki-ng:4.3
-
cpe:2.3:o:contiki-ng:contiki-ng:4.4
-
cpe:2.3:o:contiki-ng:contiki-ng:4.5
-
cpe:2.3:o:contiki-ng:contiki-ng:4.6