Podatność CVE-2024-31225

Podatność CVE-2024-31225

Publikacja: 2024-05-01

Opis:

RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. The `_on_rd_init()` function does not implement a size check before copying data to the `_result_buf` static buffer. If an attacker can craft a long enough payload, they could cause a buffer overflow. If the unchecked input above is attacker-controlled and crosses a security boundary, the impact of the buffer overflow vulnerability could range from denial of service to arbitrary code execution. This issue has yet to be patched. Users are advised to add manual bounds checking.

W naszej bazie, znaleźliśmy następujące noty dla tego CVE:

	Tytuł	Autor	Data
High	RIOT 2024.01 Buffer Overflows / Lack Of Size Checks / Out-Of-Bound Access	Marco Ivaldi	09.05.2024

Typ:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

Referencje:

https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-2572-7q7c-3965

https://github.com/RIOT-OS/RIOT/blob/master/sys/net/application_layer/cord/lc/cord_lc.c#L218

Copyright 2024, cxsecurity.com