CVE-2021-42143

2024-01-2400:00:00

mitre

www.cve.org

cve-2021-42143

contiki-ng

tinydtls

infinite loop

denial of service

handshake message

cipher suites

buffer over-read

sensitive information

AI Score

9.3

Confidence

High

EPSS

0.001

Percentile

48.6%

JSON

An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.

References

seclists.org/fulldisclosure/2024/Jan/16