CVE-2023-24817 - CVE House
Back to Database
Status published High CVE-2023-24817

RIOT-OS vulnerable to Out of Bounds write in routing with SRH

Vulnerability Description

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer. Triggering the access at the right time will corrupt other packets or the allocator metadata. Corrupting a pointer will lead to denial of service. This issue is fixed in version 2023.04. As a workaround, disable SRH in the network stack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24817

Credits & Attribution

No credits recorded in the NVD database.

References

More from RIOT-OS

View All →
CVE-2025-66647
RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass
Low 1.7
CVE-2025-66646
RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass
Low 1.7
CVE-2025-53888
RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c
Medium 6.6
CVE-2024-53980
Spoofed length byte traps CC2538 in endless loop
Medium 6.9
CVE-2024-52802
RIOT-OS missing dhcpv6_opt_t minimum header length check
High 7.5

Affected Vendor

Affected Software

RIOT
Vulnerable Versions:
< 2023.04

Timeline

Official Publish: May 30th, 2023
Last Modified: January 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-119 CWE-191

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1203 Exploitation for Client Execution
Execution
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1190 Exploit Public-Facing Application
Initial Access
T1574 Hijack Execution Flow
Privilege Escalation
T1059 Command and Scripting Interpreter
Execution
T1485 Data Destruction
Impact
T1499 Endpoint Denial of Service
Impact