Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The vulnerability exists in the os/net/app-layer/snmp/snmp-message.c module, where the snmp_message_decode function fails to check the boundary of the message buffer when reading a byte from it immediately after decoding an object identifier (OID). The problem has been patched in Contiki-NG pull request 2937. It will be included in the next release of Contiki-NG. Users are advised to either apply the patch manually or to wait for the next release. A workaround is to disable the SNMP module in the Contiki-NG build configuration.
History

Wed, 27 Nov 2024 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Contiki-ng
Contiki-ng contiki-ng
CPEs cpe:2.3:o:contiki-ng:contiki-ng:-:*:*:*:*:*:*:*
Vendors & Products Contiki-ng
Contiki-ng contiki-ng
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 27 Nov 2024 18:45:00 +0000

Type Values Removed Values Added
Description Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The vulnerability exists in the os/net/app-layer/snmp/snmp-message.c module, where the snmp_message_decode function fails to check the boundary of the message buffer when reading a byte from it immediately after decoding an object identifier (OID). The problem has been patched in Contiki-NG pull request 2937. It will be included in the next release of Contiki-NG. Users are advised to either apply the patch manually or to wait for the next release. A workaround is to disable the SNMP module in the Contiki-NG build configuration.
Title Out-of-bounds read when decoding SNMP messages in Contiki-NG
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-11-27T18:20:43.701Z

Updated: 2024-11-27T19:22:41.923Z

Reserved: 2024-07-15T15:53:28.323Z

Link: CVE-2024-41126

cve-icon Vulnrichment

Updated: 2024-11-27T19:21:49.320Z

cve-icon NVD

Status : Received

Published: 2024-11-27T19:15:33.050

Modified: 2024-11-27T19:15:33.050

Link: CVE-2024-41126

cve-icon Redhat

No data.