An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability allows remote attackers to cause a denial of service and false-positive packet drops.
DTLS servers using the vulnerable version of the tinyDTLS library improperly handle situations when a client sends a packet with an unexpectedly large epoch number early in the communication. Lack of proper validation of this value (CWE-755: improper handling of exceptional conditions, CWE-770: allocation of resources without limits) leads to disruptions in network traffic processing. As a result, the server may reject valid packets as falsely incorrect and potentially become unavailable to legitimate clients.
A remote attacker without authentication can cause denial of service (DoS) on a vulnerable DTLS server and cause false packet rejection, disrupting communication with devices based on Contiki-NG.
Apply patches available from the vendor according to the references. It is recommended to monitor the Contiki-NG tinyDTLS GitHub repository (https://github.com/contiki-ng/tinydtls) to download the patched version and update software on all devices using the vulnerable library.
Contiki-NG tinyDTLS — master branch up to and including commit 53a0d97
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HContiki Ng Tinydtls
APPContiki-Ng≤ 2018-08-30
Related vulnerabilities
Nieskończona pętla i buffer over-read w Contiki-NG tinyDTLS (DTLS ClientHello)
Buffer over-read w Contiki-NG tinyDTLS — zdalne DoS przez spreparowany pakiet
Błąd obsługi handshake DTLS w Contiki-NG tinyDTLS — denial of service
An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch...
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attack...