ID
VAR-202411-2823
CVE
CVE-2024-41125
TITLE
Contiki-NG Out-of-bounds read vulnerability in
Trust: 0.8
DESCRIPTION
Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The vulnerability exists in the os/net/app-layer/snmp/snmp-ber.c module, where the function snmp_ber_decode_string_len_buffer decodes the string length from a received SNMP packet. In one place, one byte is read from the buffer, without checking that the buffer has another byte available, leading to a possible out-of-bounds read. The problem has been patched in Contiki-NG pull request #2936. It will be included in the next release of Contiki-NG. Users are advised to apply the patch manually or to wait for the next release. A workaround is to disable the SNMP module in the Contiki-NG build configuration. Contiki-NG Exists in an out-of-bounds read vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
Trust: 1.62
AFFECTED PRODUCTS
| vendor: | contiki ng | model: | contiki-ng | scope: | lte | version: | 4.9 | Trust: 1.0 |
| vendor: | contiki ng | model: | contiki-ng | scope: | - | version: | - | Trust: 0.8 |
| vendor: | contiki ng | model: | contiki-ng | scope: | lte | version: | 4.9 and earlier | Trust: 0.8 |
| vendor: | contiki ng | model: | contiki-ng | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-125 | Trust: 1.0 |
| problemtype: | Out-of-bounds read (CWE-125) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-41125 | Trust: 2.6 |
| db: | JVNDB | id: | JVNDB-2024-022137 | Trust: 0.8 |
REFERENCES
| url: | https://github.com/contiki-ng/contiki-ng/pull/2936 | Trust: 1.8 |
| url: | https://github.com/contiki-ng/contiki-ng/security/advisories/ghsa-qjj3-gqx7-438w | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-41125 | Trust: 0.8 |
SOURCES
| db: | JVNDB | id: | JVNDB-2024-022137 |
| db: | NVD | id: | CVE-2024-41125 |
LAST UPDATE DATE
2025-04-18T04:05:19.250000+00:00
SOURCES UPDATE DATE
| db: | JVNDB | id: | JVNDB-2024-022137 | date: | 2025-04-16T00:39:00 |
| db: | NVD | id: | CVE-2024-41125 | date: | 2025-04-10T14:55:43.850 |
SOURCES RELEASE DATE
| db: | JVNDB | id: | JVNDB-2024-022137 | date: | 2025-04-16T00:00:00 |
| db: | NVD | id: | CVE-2024-41125 | date: | 2024-11-27T19:15:32.883 |