CVE-2023-33974 - CVE House
Back to Database
Status published High CVE-2023-33974

RIOT-OS vulnerable to Race Condition in SFR Timeout

Vulnerability Description

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device to trigger a race condition. The race condition invalidates assumptions about the program state and leads to an invalid memory access resulting in denial of service. This issue is patched in pull request 19679. There are no known workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-33974

Credits & Attribution

No credits recorded in the NVD database.

References

More from RIOT-OS

View All →
CVE-2025-66647
RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass
Low 1.7
CVE-2025-66646
RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass
Low 1.7
CVE-2025-53888
RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c
Medium 6.6
CVE-2024-53980
Spoofed length byte traps CC2538 in endless loop
Medium 6.9
CVE-2024-52802
RIOT-OS missing dhcpv6_opt_t minimum header length check
High 7.5

Affected Vendor

Affected Software

RIOT
Vulnerable Versions:
<= 2023.01

Timeline

Official Publish: May 30th, 2023
Last Modified: January 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-362

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1574 Hijack Execution Flow
Persistence
T1565 Data Manipulation
Impact
T1499 Endpoint Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access