CVE-2019-9183: contiki-ng Integer Underflow (Wrap or Wraparound)
Vulnerability summary
CVE-2019-9183 is a high (CVSS 7.5) Integer Underflow (Wrap or Wraparound) vulnerability in contiki-ng. EPSS estimates a 2.31% chance of exploitation in the next 30 days, higher than 83.2% of scored vulnerabilities.
Timeline
- 23-04-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. A buffer overflow is present due to an integer underflow during 6LoWPAN fragment processing in the face of truncated fragments in os/net/ipv6/sicslowpan.c. This results in accesses of unmapped memory, crashing the application. An attacker can cause a denial-of-service via a crafted 6LoWPAN frame.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.31%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.31% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Contiki-ng1 product
- contiki-ng≤ 4.3
Contiki-os1 product
- contiki≤ 3.0
2 vendors · 2 products
References
3 links- github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.4X Refsource CONFIRMRelease NotesThird Party Advisory
- www.usenix.org/system/files/sec20summer_clements_prepub.pdfX Refsource MISCTechnical DescriptionThird Party Advisory