CVE-2023-33975— RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-33975
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add
Source: NVD (National Vulnerability Database)
Vulnerability Description
RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. This issue is fixed in pull request 19680. As a workaround, disable support for fragmented IP datagrams.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
内存缓冲区边界内操作的限制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
RIOT RIOT-OS 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RIOT RIOT-OS是一套应用于物联网领域的操作系统。 RIOT-OS 2023.01及之前版本存在安全漏洞，该漏洞源于缓冲区越界写入，攻击者利用该漏洞可以进行拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-33975
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-33975
请登录查看更多情报信息。
- https://github.com/RIOT-OS/RIOT/pull/19680x_refsource_MISC
- https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-f6ff-g7mh-58q4x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2023-33975
Same Patch Batch · RIOT-OS · 2023-05-30 · 6 CVEs total
| CVE-2023-33974 | 7.5 HIGH | RIOT-OS vulnerable to Race Condition in SFR Timeout |
| CVE-2023-33973 | 7.5 HIGH | RIOT-OS vulnerable to NULL pointer dereference during NHC encoding |
| CVE-2023-24825 | 7.5 HIGH | RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark |
| CVE-2023-24817 | 7.5 HIGH | RIOT-OS vulnerable to Out of Bounds write in routing with SRH |
| CVE-2023-24826 | 5.9 MEDIUM | Usage of Uninitialized Timer during forwarding of Fragments with SFR |
IV. Related Vulnerabilities
Same product: RIOT
- CVE-2026-27703
RIOT has an Out-of-Bounds Write in nanoCoAP Handler - CVE-2026-25139
RIOT Vulnerable to Multiple Out-of-Bounds Read When Processi - CVE-2025-66647
RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass - CVE-2025-66646
RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_r - CVE-2025-53888
RIOT-OS has an ineffective size check that can lead to buffe
Same vendor: RIOT-OS
- CVE-2026-27703
RIOT has an Out-of-Bounds Write in nanoCoAP Handler - CVE-2026-25139
RIOT Vulnerable to Multiple Out-of-Bounds Read When Processi - CVE-2025-66647
RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass - CVE-2025-66646
RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_r - CVE-2025-53888
RIOT-OS has an ineffective size check that can lead to buffe
Same weakness: CWE-119
- CVE-2026-22167
GPU DDK - Cache resident PM buffers writable by other GPU re - CVE-2026-27890
Firebird has Pre-Auth DOS when Processing Out of Order CNCT_ - CVE-2026-34864
Huawei HarmonyOS 安全漏洞 - CVE-2026-4149
Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code - CVE-2026-34988
Wasmtime leaks data between pooling allocator instances
V. Comments for CVE-2023-33975
No comments yet