CVE-2021-28362
📋 TL;DR
This vulnerability in Contiki OS allows attackers to send specially crafted IPv6 packets with invalid extension headers, causing integer underflow and memory corruption. This leads to denial-of-service conditions by crashing affected devices. It affects all Contiki-based IoT devices and embedded systems using IPv6 networking.
💻 Affected Systems
- Contiki OS
📦 What is this software?
Contiki by Contiki Os
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash requiring physical reset, potentially leading to permanent device failure in resource-constrained IoT devices.
Likely Case
Denial-of-service through system crash or reboot, disrupting device functionality until manual intervention.
If Mitigated
No impact if IPv6 is disabled or proper network filtering blocks malicious packets.
🎯 Exploit Status
Exploitation requires sending crafted IPv6 packets. Public details available in CERT advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contiki 3.x with security patches
Vendor Advisory: https://github.com/contiki-os/contiki/releases
Restart Required: Yes
Instructions:
1. Update Contiki OS to patched version. 2. Recompile and redeploy firmware to affected devices. 3. Verify IPv6 packet handling functions in rpl-ext-header.c are updated.
🔧 Temporary Workarounds
Disable IPv6
allDisable IPv6 networking if not required for device functionality
# Configure network settings to use IPv4 only
# Disable IPv6 in Contiki configuration
Network Filtering
linuxBlock or filter IPv6 packets with extension headers at network perimeter
# Example iptables rule: iptables -A INPUT -p ipv6 --dport any -j DROP
# Configure firewall to restrict IPv6 traffic
🧯 If You Can't Patch
- Segment affected devices on isolated network segments
- Implement strict network ACLs to limit IPv6 traffic to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check Contiki version and verify if IPv6 is enabled. Review rpl-ext-header.c source code for integer underflow checks.Check Version:
# Check Contiki version in source code or device firmwareVerify Fix Applied:
Verify Contiki version is patched and test with crafted IPv6 packets to ensure no crash occurs.📡 Detection & Monitoring
Log Indicators:
- System crash logs
- Kernel panic messages
- IPv6 packet processing errors
Network Indicators:
- Unusual IPv6 packets with malformed extension headers
- Spike in ICMPv6 error messages
SIEM Query:
source="network" proto="ipv6" (header_length < payload_length OR extension_header malformed)