An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.
An attacker sends a crafted ClientHello message containing an odd-length cipher suites list. Invalid input causes the handshake processing code to enter an infinite loop that consumes all available system resources. At the same time, a read beyond buffer boundaries (buffer over-read) occurs, which may lead to disclosure of sensitive information stored in the process memory.
An attacker can completely disable a device or process using the tinyDTLS library (DoS), and potentially gain access to sensitive data from memory by exploiting the buffer over-read error.
Apply patches available from the vendor according to the references. It is recommended to update the tinyDTLS library to a version containing a fix for the cipher suites field handling error in the ClientHello message and to monitor publicly available repositories of the Contiki-NG project for patch releases.
Contiki-NG tinyDTLS — master branch up to and including commit 53a0d97
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HContiki Ng Tinydtls
APPContiki-Ng≤ 2018-08-30
Related vulnerabilities
Buffer over-read w Contiki-NG tinyDTLS — zdalne DoS przez spreparowany pakiet
Nieprawidłowa obsługa dużego numeru epoki w Contiki-NG tinyDTLS — DoS i fałszywe odrzucanie pakietów
Błąd obsługi handshake DTLS w Contiki-NG tinyDTLS — denial of service
An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch...
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attack...