Impact

The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system do not validate the address pointer in the RPL source routing header This makes it possible for an attacker to cause out-of-bounds writes with packets injected into the network stack.

Specifically, the problem lies in the rpl_ext_header_srh_update function in the two rpl-ext-header.c modules for RPL-Classic and RPL-Lite respectively. The addr_ptr variable is calculated using an unvalidated CMPR field value from the source routing header. An out-of-bounds write can be triggered on line 151 in os/net/routing/rpl-lite/rpl-ext-header.c and line 261 in os/net/routing/rpl-classic/rpl-ext-header.c, which contain the following memcpy call with addr_ptr as destination.

memcpy(addr_ptr, ((uint8_t *)&current_dest_addr) + cmpr, 16 - cmpr);

Patches

The problem has been patched in Contiki-NG 4.6.

Workarounds

Users can apply the patch in Contiki-NG PR #1431.

References

For more information

If you have any questions or comments about this advisory:

• Open an issue in https://github.com/contiki-ng/contiki-ng/
• Email us at security@contiki-ng.org