Impact
When a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify that a full TCP header has been received. Specifically, the implementation attempts to access the flags field from the TCP buffer in the following conditional expression in the check_for_tcp_syn function.
(UIP_TCP_BUF->flags & TCP_SYN) == TCP_SYN)
For this reason, an attacker can inject a truncated TCP packet, which will lead to a memory read outside the packet data.
Patches
The problem has been patched in the "develop" branch of Contiki-NG.
Workarounds
One can apply the changes in Contiki-NG pull request #2510 to patch the system.
For more information
If you have any questions or comments about this advisory:
Open an issue in https://github.com/contiki-ng/contiki-ng
Email us at security@contiki-ng.org
Impact
When a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify that a full TCP header has been received. Specifically, the implementation attempts to access the flags field from the TCP buffer in the following conditional expression in the
check_for_tcp_synfunction.(UIP_TCP_BUF->flags & TCP_SYN) == TCP_SYN)For this reason, an attacker can inject a truncated TCP packet, which will lead to a memory read outside the packet data.
Patches
The problem has been patched in the "develop" branch of Contiki-NG.
Workarounds
One can apply the changes in Contiki-NG pull request #2510 to patch the system.
For more information
If you have any questions or comments about this advisory:
Open an issue in https://github.com/contiki-ng/contiki-ng
Email us at security@contiki-ng.org