Back to Database
Status published
High
CVE-2023-24825
RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark
Vulnerability Description
RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24825
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xqm8-xj74-fjw2
- https://github.com/RIOT-OS/RIOT/commit/0c522075445a62ce3102e141573ecc2788521897
- https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L416
- https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L429
- https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L729
- https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L761
- https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L169
More from RIOT-OS
View All →CVE-2025-66647
RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass
Low
1.7
CVE-2025-66646
RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass
Low
1.7
CVE-2025-53888
RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c
Medium
6.6
CVE-2024-53980
Spoofed length byte traps CC2538 in endless loop
Medium
6.9
CVE-2024-52802
RIOT-OS missing dhcpv6_opt_t minimum header length check
High
7.5
Affected Vendor
RIOT-OS
View all reports →Affected Software
RIOT
Vulnerable Versions:
< 2023.04
Timeline
Official Publish:
May 30th, 2023
Last Modified:
January 10th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H