CVE-2021-21281 — Buffer overflow due to unvalidated TCP data offset
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions prior to 4.6. After e…
Published: 2021-06-18 · CVSS: 7.0 · CVSS 3.1
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions prior to 4.6. After establishing a TCP socket using the tcp-socket library, it is possible for the remote end to send a packet with a data offset that is unvalidated. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaround.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7