Vulnerability Description
Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contiki-NG operating system in versions 4.8 and prior. The problem exists in the Contiki File System (CFS) backend for the storage of data (file os/storage/antelope/storage-cfs.c). In the functions `storage_get_index` and `storage_put_index`, a buffer for merging two strings is allocated with one byte less than the maximum size of the merged strings, causing subsequent function calls to the cfs_open function to read from memory beyond the buffer size. The vulnerability has been patched in the "develop" branch of Contiki-NG, and is expected to be included in the next release. As a workaround, the problem can be fixed by applying the patch in Contiki-NG pull request #2425.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Contiki-Ng | Contiki-Ng | <= 4.8 |
Related Weaknesses (CWE)
References
- https://github.com/contiki-ng/contiki-ng/pull/2425Patch
- https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-257g-w39m-5jj4Vendor Advisory
- https://github.com/contiki-ng/contiki-ng/pull/2425Patch
- https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-257g-w39m-5jj4Vendor Advisory
FAQ
What is CVE-2023-30546?
CVE-2023-30546 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contiki-NG operating system in versions 4.8 and...
How severe is CVE-2023-30546?
CVE-2023-30546 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-30546?
Check the references section above for vendor advisories and patch information. Affected products include: Contiki-Ng Contiki-Ng.