CyberRota Analysis
AI-GeneratedThe vulnerability in Contiki-NG's LwM2M TLV parser allows for out-of-bounds reads of heap memory due to improper handling of buffer length, potentially exposing sensitive information such as key material and peer addresses. This issue can be exploited through crafted CoAP WRITE requests to LwM2M endpoints, particularly affecting devices operating in NoSec mode, which do not require authentication. Organizations using Contiki-NG in constrained environments should prioritize addressing this vulnerability to safeguard their deployments against potential data leaks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.