CVE-2021-21257

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system versions prior to 4.6 do not validate the address pointer in the RPL source routing header This makes it possible for an...

CVE-2021-21280

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Contiki-NG prior to 4.6 when transmitting a 6LoWPAN packet with a chain of extension headers. Unfortunately, the written header is not checke...

CVE-2021-21280

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Contiki-NG prior to 4.6 when transmitting a 6LoWPAN packet with a chain of extension headers. Unfortunately, the written header is not checke...

CVE-2021-21410

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function uncompresshdriphc does not perform proper boundary chec...

Design/Logic Flaw

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation NS messages. This type of attack can effectively...

Out-of-bounds

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function uncompresshdriphc does not perform proper boundary chec...

Out-of-bounds

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system versions prior to 4.6 do not validate the address pointer in the RPL source routing header This makes it possible for an...

Buffer overflow

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions prior to 4.6. After establishing a TCP socket using the tcp-socket library, it is possible for the remote end to send a packet with a data...

Design/Logic Flaw

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Contiki-NG prior to 4.6 when transmitting a 6LoWPAN packet with a chain of extension headers. Unfortunately, the written header is not checke...

CVE-2021-21410 Out-of-bounds read in the 6LoWPAN implementation

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function uncompresshdriphc does not perform proper boundary chec...

CVE-2021-21410

Contiki-NG vulnerability CVE-2021-21410: an out-of-bounds read in the 6LoWPAN IPv6 header decompression (uncompress_hdr_iphc) affects Contiki-NG 4.6 and earlier. The function does not perform proper boundary checks when reading from the packet buffer, enabling construction of a compressed 6LoWPAN...

CVE-2021-21257 Out-of-bounds write in RPL-Classic and RPL-Lite

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system versions prior to 4.6 do not validate the address pointer in the RPL source routing header This makes it possible for an...

CVE-2021-21257

Contiki-NG prior to version 4.6 is affected by CVE-2021-21257 due to an out-of-bounds write in the RPL-Classic and RPL-Lite implementations. The bug occurs in rpl_ext_header_srh_update where addr_ptr is derived from an unvalidated CMPR field in the RPL source routing header, enabling out-of-bound...

CVE-2021-21279

Contiki-NG prior to version 4.6 is affected by an infinite loop in the IPv6 Neighbor Solicitation handling which can lead to a denial-of-service due to the cooperative scheduling in the network stack. The issue is mitigated by upgrading to Contiki-NG 4.6 (patched) as the primary fix; an out-of-ba...

CVE-2021-21279 Infinite loop in IPv6 neighbor solicitation processing

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation NS messages. This type of attack can effectively...

CVE-2021-21280 Out-of-bounds write when processing 6LoWPAN extension headers

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Contiki-NG prior to 4.6 when transmitting a 6LoWPAN packet with a chain of extension headers. Unfortunately, the written header is not checke...

CVE-2021-21280

Contiki-NG versions prior to 4.6 are vulnerable to an out-of-bounds write when processing a 6LoWPAN packet with a chain of extension headers. The root cause is that the written header is not checked to be within the available space, allowing a buffer overwrite. The issue was patched in Contiki-NG...

CVE-2021-21281 Buffer overflow due to unvalidated TCP data offset

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions prior to 4.6. After establishing a TCP socket using the tcp-socket library, it is possible for the remote end to send a packet with a data...

CVE-2021-21281

Contiki-NG contains a buffer overflow vulnerability in versions prior to 4.6 tied to unvalidated TCP data offsets after a tcp-socket is established. The remote end can send a packet with an unvalidated data offset, potentially leading to memory corruption or denial of service. A fix was introduce...

CVE-2021-21282

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In versions prior to 4.5, buffer overflow can be triggered by an input packet when using either of Contiki-NG's two RPL implementations in source-routing mode. The problem has been patched in Contiki-NG...