CVE-2023-34100
📋 TL;DR
This CVE describes a buffer overflow vulnerability in Contiki-NG's TCP MSS option parsing for IPv6 packets. Attackers can trigger out-of-bounds memory reads by sending specially crafted packets, potentially leading to information disclosure or system crashes. All devices running vulnerable versions of Contiki-NG with IPv6 enabled are affected.
💻 Affected Systems
- Contiki-NG
📦 What is this software?
Contiki Ng by Contiki Ng
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, though this would require additional memory corruption vulnerabilities to be chained together.
Likely Case
Denial of service through system crashes or information disclosure via memory leaks from out-of-bounds reads.
If Mitigated
Minimal impact with proper network segmentation and monitoring, as the vulnerability requires network access to exploit.
🎯 Exploit Status
Exploitation requires sending specially crafted IPv6 TCP packets to vulnerable devices. No authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9 (currently in develop branch)
Vendor Advisory: https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-3v7c-jq9x-cmph
Restart Required: Yes
Instructions:
1. Monitor for Contiki-NG 4.9 release. 2. Update to version 4.9 when available. 3. Alternatively, manually apply patch from commit cde4e9839. 4. Recompile and redeploy Contiki-NG on affected devices.
🔧 Temporary Workarounds
Manual patch application
allApply the fix from the GitHub commit before official release
git apply <patch_file> or manually edit os/net/ipv6/uip6.c
🧯 If You Can't Patch
- Disable IPv6 on affected devices if possible
- Implement network segmentation to isolate Contiki-NG devices from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check Contiki-NG version and verify if running pre-4.9. Examine if IPv6 is enabled in configuration.Check Version:
Check Contiki-NG build configuration or version headersVerify Fix Applied:
Verify version is 4.9 or later, or check that commit cde4e9839 is included in the codebase.📡 Detection & Monitoring
Log Indicators:
- System crashes
- Memory access violation logs
- Unexpected reboots
Network Indicators:
- Unusual IPv6 TCP packets with MSS options
- Traffic to Contiki-NG devices from unexpected sources
SIEM Query:
Search for network traffic patterns matching IPv6 TCP packets with MSS options to IoT device subnets🔗 References
- https://github.com/contiki-ng/contiki-ng/pull/2434/commits/cde4e98398a2f5b994972c8459342af3ba93b98e
- https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-3v7c-jq9x-cmph
- https://github.com/contiki-ng/contiki-ng/pull/2434/commits/cde4e98398a2f5b994972c8459342af3ba93b98e
- https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-3v7c-jq9x-cmph
