CVE-2023-24822 - CVE House
Back to Database
Status published High CVE-2023-24822

RIOT-OS vulnerable to Null Pointer dereference during IPHC encoding

Vulnerability Description

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference while encoding a 6LoWPAN IPHC header. The NULL pointer dereference causes a hard fault exception, leading to denial of service. Version 2022.10 fixes this issue. As a workaround, apply the patches manually.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24822

Credits & Attribution

No credits recorded in the NVD database.

References

More from RIOT-OS

View All →
CVE-2025-66647
RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass
Low 1.7
CVE-2025-66646
RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass
Low 1.7
CVE-2025-53888
RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c
Medium 6.6
CVE-2024-53980
Spoofed length byte traps CC2538 in endless loop
Medium 6.9
CVE-2024-52802
RIOT-OS missing dhcpv6_opt_t minimum header length check
High 7.5

Affected Vendor

Affected Software

RIOT
Vulnerable Versions:
< 2022.10

Timeline

Official Publish: April 24th, 2023
Last Modified: February 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-476

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1499.004 Application or System Exploitation
Impact
T1489 Service Stop
Impact
T1203 Exploitation for Client Execution
Execution
T1190 Exploit Public-Facing Application
Initial Access