CVE-2023-28116: Buffer overflow in L2CAP due to misconfigured MTU

Vulnerability summary

CVE-2023-28116 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in contiki-ng. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.1% of scored vulnerabilities.

Timeline

1. 17-03-2023
   PublishedVulnerability first disclosed.
2. 25-02-2025
   Last modifiedVulnerability information updated.

Description

Contiki-NG is an open-source, cross-platform operating system for internet of things (IoT) devices. In versions 4.8 and prior, an out-of-bounds write can occur in the BLE L2CAP module of the Contiki-NG operating system. The network stack of Contiki-NG uses a global buffer (packetbuf) for processing of packets, with the size of PACKETBUF_SIZE. In particular, when using the BLE L2CAP module with the default configuration, the PACKETBUF_SIZE value becomes larger then the actual size of the packetbuf. When large packets are processed by the L2CAP module, a buffer overflow can therefore occur when copying the packet data to the packetbuf. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. The problem can be worked around by applying the patch manually.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.