CVE-2023-24818 – CVE-2023-24818 is a NULL pointer dereference vu... (How to Fix)

Q: What is the severity of CVE-2023-24818?

CVE-2023-24818 has a CVSS score of 7.5 (HIGH). CVE-2023-24818 is a NULL pointer dereference vulnerability in RIOT-OS's 6LoWPAN network stack that allows attackers to cause denial of service by sending crafted fragmented frames. The vulnerability affects RIOT-OS versions prior to 2022.10, impacting Internet of Things devices running this operating system.

📋 TL;DR

CVE-2023-24818 is a NULL pointer dereference vulnerability in RIOT-OS's 6LoWPAN network stack that allows attackers to cause denial of service by sending crafted fragmented frames. The vulnerability affects RIOT-OS versions prior to 2022.10, impacting Internet of Things devices running this operating system.

💻 Affected Systems

Products:

RIOT-OS

Versions: All versions prior to 2022.10

Operating Systems: RIOT-OS

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with 6LoWPAN fragmentation enabled, which is default in many configurations.

📦 What is this software?

Riot by Riot Os

View all CVEs affecting Riot →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device crash requiring physical reset or power cycle, potentially disrupting critical IoT operations.

🟠

Likely Case

Device becomes unresponsive, requiring manual intervention to restore functionality.

🟢

If Mitigated

No impact if fragmentation is disabled or patches are applied.

🌐 Internet-Facing: HIGH - IoT devices are often internet-accessible and vulnerable to unauthenticated network attacks.

🏢 Internal Only: MEDIUM - Still vulnerable to internal attackers or compromised devices on the same network.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Requires sending crafted network packets.

Exploitation requires network access to the device but no authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2022.10

Vendor Advisory: https://github.com/RIOT-OS/RIOT/security/advisories

Restart Required: Yes

Instructions:

1. Update RIOT-OS to version 2022.10 or later. 2. Rebuild and redeploy firmware to affected devices. 3. Verify the fix by checking the version.

🔧 Temporary Workarounds

Disable 6LoWPAN fragmentation

all

Prevents processing of fragmented IP datagrams that trigger the vulnerability.

CONFIG_GNRC_SIXLOWPAN_FRAGMENT_RBUF_SIZE=0

🧯 If You Can't Patch

Implement network segmentation to isolate IoT devices from untrusted networks.
Use network firewalls to block fragmented 6LoWPAN packets to vulnerable devices.

🔍 How to Verify

Check if Vulnerable:

Check RIOT-OS version: if version < 2022.10 and 6LoWPAN fragmentation is enabled, device is vulnerable.

Check Version:

Use RIOT shell command 'version' or check firmware build information.

Verify Fix Applied:

Verify RIOT-OS version is 2022.10 or later and test with fragmented packet transmission.

📡 Detection & Monitoring

Log Indicators:

Hard fault exceptions
Device crash/reboot logs
Network stack error messages

Network Indicators:

Unusual fragmented 6LoWPAN packets
Sudden device unresponsiveness after network traffic

SIEM Query:

Search for: 'hard fault' OR 'null pointer' OR 'reboot' from IoT device logs

📊 Metadata

CVE ID: CVE-2023-24818

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: April 24, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-24818, you might also want to check these: