CVE-2023-24821 - CVE House
Back to Database
Status published High CVE-2023-24821

RIOT-OS vulnerable to Integer Underflow during defragmentation

Vulnerability Description

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault exception after reaching the last page of RAM. The hard fault is not handled and the system will be stuck until reset, thus the impact is denial of service. Version 2022.10 fixes this issue. As a workaround, disable support for fragmented IP datagrams or apply the patches manually.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24821

Credits & Attribution

No credits recorded in the NVD database.

References

More from RIOT-OS

View All →
CVE-2025-66647
RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass
Low 1.7
CVE-2025-66646
RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass
Low 1.7
CVE-2025-53888
RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c
Medium 6.6
CVE-2024-53980
Spoofed length byte traps CC2538 in endless loop
Medium 6.9
CVE-2024-52802
RIOT-OS missing dhcpv6_opt_t minimum header length check
High 7.5

Affected Vendor

Affected Software

RIOT
Vulnerable Versions:
< 2022.10

Timeline

Official Publish: April 24th, 2023
Last Modified: February 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-191 CWE-787

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1574 Hijack Execution Flow
Privilege Escalation
T1059 Command and Scripting Interpreter
Execution
T1485 Data Destruction
Impact
T1499 Endpoint Denial of Service
Impact
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control