CVE-2023-33973
📋 TL;DR
CVE-2023-33973 is a NULL pointer dereference vulnerability in RIOT-OS's 6LoWPAN network stack that allows remote attackers to crash IoT devices by sending specially crafted frames. This leads to denial of service, affecting all devices running RIOT-OS versions 2023.01 and earlier with 6LoWPAN enabled.
💻 Affected Systems
- RIOT-OS
📦 What is this software?
Riot by Riot Os
⚠️ Risk & Real-World Impact
Worst Case
Permanent device crash requiring physical reset or power cycle, potentially disrupting critical IoT operations in industrial or infrastructure environments.
Likely Case
Temporary denial of service until device automatically reboots or is manually reset, disrupting IoT network communications.
If Mitigated
No impact if patched or if 6LoWPAN functionality is disabled in network configuration.
🎯 Exploit Status
Exploitation requires sending crafted 6LoWPAN frames but no authentication or special privileges needed. The vulnerability is in packet forwarding logic, making it accessible to network attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after pull request 19678 (post-2023.01)
Vendor Advisory: https://github.com/RIOT-OS/RIOT/pull/19678
Restart Required: Yes
Instructions:
1. Update RIOT-OS to latest version incorporating PR 19678. 2. Recompile and redeploy firmware to affected IoT devices. 3. Restart devices to apply the updated firmware.
🔧 Temporary Workarounds
Disable 6LoWPAN forwarding
allConfigure devices to not forward 6LoWPAN packets if not required for functionality
# Requires modifying RIOT-OS network configuration to disable 6LoWPAN packet processing
Network segmentation
allIsolate IoT devices with 6LoWPAN in separate network segments with strict ingress filtering
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send packets to IoT devices
- Deploy network intrusion detection to monitor for crafted 6LoWPAN frames and alert on potential exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check RIOT-OS version: if running 2023.01 or earlier and 6LoWPAN is enabled, device is vulnerable.Check Version:
Check RIOT-OS build configuration or firmware version information specific to your device implementationVerify Fix Applied:
Verify RIOT-OS version is newer than 2023.01 and includes commit from PR 19678 in the codebase.📡 Detection & Monitoring
Log Indicators:
- Device crash/reboot logs
- Kernel panic messages related to NULL pointer dereference in network stack
Network Indicators:
- Unusual 6LoWPAN frame patterns
- Sudden cessation of network traffic from IoT devices
SIEM Query:
search 'RIOT-OS crash' OR 'NULL pointer dereference' AND source="iot_device"🔗 References
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1067
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1495
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1511
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1644
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1655
- https://github.com/RIOT-OS/RIOT/commit/c9d7863e5664a169035038628029bb07e090c5ff
- https://github.com/RIOT-OS/RIOT/pull/19678
- https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-r2pv-3jqc-vh7w
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1067
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1495
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1511
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1644
- https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1655
- https://github.com/RIOT-OS/RIOT/commit/c9d7863e5664a169035038628029bb07e090c5ff
- https://github.com/RIOT-OS/RIOT/pull/19678
- https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-r2pv-3jqc-vh7w
