An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet.
The product writes data past the end, or before the beginning, of the intended buffer.
Link | Tags |
---|---|
https://www.kb.cert.org/vuls/id/815128 | third party advisory us government resource |
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 | third party advisory us government resource |