CVE-2023-24822 – CVE-2023-24822 is a NULL pointer dereference vu... (How to Fix)

Q: What is the severity of CVE-2023-24822?

CVE-2023-24822 has a CVSS score of 7.5 (HIGH). CVE-2023-24822 is a NULL pointer dereference vulnerability in RIOT-OS's 6LoWPAN network stack that allows attackers to cause denial of service by sending crafted frames. When exploited, it triggers a hard fault exception that crashes affected IoT devices. This affects all RIOT-OS deployments using versions before 2022.10 that process 6LoWPAN network traffic.

📋 TL;DR

CVE-2023-24822 is a NULL pointer dereference vulnerability in RIOT-OS's 6LoWPAN network stack that allows attackers to cause denial of service by sending crafted frames. When exploited, it triggers a hard fault exception that crashes affected IoT devices. This affects all RIOT-OS deployments using versions before 2022.10 that process 6LoWPAN network traffic.

💻 Affected Systems

Products:

RIOT-OS

Versions: All versions before 2022.10

Operating Systems: RIOT-OS

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects devices using RIOT-OS with 6LoWPAN network stack enabled and processing IPHC headers.

📦 What is this software?

Riot by Riot Os

View all CVEs affecting Riot →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Permanent device crash requiring physical reset or power cycle, potentially disrupting critical IoT operations in industrial, medical, or infrastructure systems.

🟠

Likely Case

Temporary denial of service requiring device reboot, disrupting normal IoT device functionality until recovery.

🟢

If Mitigated

No impact if patched or workarounds applied; devices continue normal operation without vulnerability.

🌐 Internet-Facing: HIGH - IoT devices often have internet-facing interfaces and 6LoWPAN traffic can be crafted remotely.

🏢 Internal Only: MEDIUM - Internal network attackers could still exploit if they can send crafted 6LoWPAN frames to vulnerable devices.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Requires sending crafted 6LoWPAN frames but no authentication needed.

Exploitation requires network access to send crafted frames to vulnerable devices.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2022.10

Vendor Advisory: https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-8x69-5fhj-72wh

Restart Required: Yes

Instructions:

1. Update RIOT-OS to version 2022.10 or later. 2. Rebuild firmware with updated RIOT-OS source. 3. Flash updated firmware to affected devices. 4. Restart devices to apply changes.

🔧 Temporary Workarounds

Manual patch application

all

Apply the specific commits that fix the NULL pointer dereference in the 6LoWPAN IPHC header encoding.

git cherry-pick 639c04325de4ceb9d444955f4927bfae95843a39
git cherry-pick 7253e261556f252816f4a3b7c4f96fc10d642485

🧯 If You Can't Patch

Implement network segmentation to isolate IoT devices from untrusted networks.
Use firewalls to block or filter 6LoWPAN traffic from unauthorized sources.

🔍 How to Verify

Check if Vulnerable:

Check RIOT-OS version: if using version earlier than 2022.10 and 6LoWPAN is enabled, device is vulnerable.

Check Version:

Check RIOT-OS version in source code or firmware: grep 'RIOT_VERSION' in source or check device firmware version.

Verify Fix Applied:

Verify RIOT-OS version is 2022.10 or later and test with crafted 6LoWPAN frames to ensure no crash occurs.

📡 Detection & Monitoring

Log Indicators:

Hard fault exception logs
Device crash/restart events
6LoWPAN parsing errors

Network Indicators:

Unusual 6LoWPAN frame patterns
Crafted IPHC headers in network traffic

SIEM Query:

Search for: 'hard fault' OR 'NULL pointer' OR '6LoWPAN crash' in device logs

📊 Metadata

CVE ID: CVE-2023-24822

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: April 24, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-24822, you might also want to check these: