漏洞标题
`RPL-Lite`中，`Contiki-NG`未验证的DIO前缀信息长度
漏洞描述信息
Contiki-NG是一个开源的、跨平台的操作系统，适用于下一代物联网设备。在使用Contiki-NG操作系统中RPL-Lite实现时，可能会因为接收到来自DIO的消息而导致越界读取。
具体来说，DIO消息的前缀信息包含一个字段，用于指定IPv6地址前缀的长度。该字段的值未进行验证，这意味着攻击者可以设置超过最大前缀长度的值。
随后，一个memcmp函数调用会被用来比较不同的前缀，这时传递给函数的长度参数会超出为前缀分配的数组边界，导致越界读取。
这个问题已经在Contiki-NG的"develop"分支中进行了修补，并预计会在接下来的版本发布中包含。建议用户尽快更新到最新版本，或者手动应用Contiki-NG拉取请求#2721中的更改。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
漏洞类别
跨界内存读
漏洞标题
Unvalidated DIO prefix info length in RPL-Lite in Contiki-NG
漏洞描述信息
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message contains a field that specifies the length of an IPv6 address prefix. The value of this field is not validated, which means that an attacker can set a value that is longer than the maximum prefix length. Subsequently, a memcmp function call that compares different prefixes can be called with a length argument that surpasses the boundary of the array allocated for the prefix, causing an out-of-bounds read. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in the next release. Users are advised to update as soon as they are able to or to manually apply the changes in Contiki-NG pull request #2721.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞类别
跨界内存读
漏洞标题
Contiki-NG 缓冲区错误漏洞
漏洞描述信息
Contiki-NG是一套用于下一代IoT（物联网）设备的开源跨平台操作系统。 Contiki-NG 4.9及之前版本存在缓冲区错误漏洞，该漏洞源于使用RPL Lite实现时，传入的DIO消息可能会导致越界读取。
CVSS信息
N/A
漏洞类别
缓冲区错误