Impact

RIOT-OS contains a network stack with the ability to process 6LoWPAN frames. An attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code.

Patches

None

Workarounds

• Disabling support for fragmented IP datagrams

For more information

If you have any questions or comments about this advisory:

• Open an issue in RIOT
• Email us at RIOT-security

Bug Details

During reassembling of 6LoWPAN packets _rbuf_add is used to add incoming fragments to the buffer.
In _rbuf_add the datagram_size is retrieved from the fragment (source):

    datagram_size = sixlowpan_frag_datagram_size(pkt->data);

Afterwards the fragment size is checked to not exceed the datagram size (source):

    if ((offset + frag_size) > entry.super->datagram_size) {

If the packet is the first fragment and it uses SFR the datagram size is reduced by one (source):

        else if (IS_USED(MODULE_GNRC_SIXLOWPAN_FRAG_SFR) &&
                 sixlowpan_sfr_rfrag_is(pkt->data)) {
            entry.super->datagram_size--;
        }

Next the reassembly buffer is resized to the new smaller datagram size (source):

    if (IS_USED(MODULE_GNRC_SIXLOWPAN_FRAG_MINFWD) ||
        IS_USED(MODULE_GNRC_SIXLOWPAN_FRAG_SFR)) {
        /* all cases to try forwarding with minfwd or SFR above failed so
         * just do normal reassembly. For the `minfwd` case however, we need
         * to resize `entry.rbuf->pkt`, since we kept the packet allocation
         * with fragment forwarding as minimal as possible in
         * `_rbuf_get()` */
        res = _rbuf_resize_for_reassembly(entry.rbuf);
        if (res == RBUF_ADD_ERROR) {
            gnrc_pktbuf_release(pkt);
            return res;
        }
    }

The reassembly buffer is now one byte smaller than the fragment.
The fragment data is now copied into the reassembly buffer overflowing it by one byte (source):

    memcpy(((uint8_t *)entry.rbuf->pkt->data) + offset, data,
           frag_size);