CVE-2021-42143

An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://seclists.org/fulldisclosure/2024/Jan/16	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jan/16
https://seclists.org/fulldisclosure/2024/Jan/16	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:contiki-ng:tinydtls:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-01-24 18:15

Updated : 2024-11-21 06:27

NVD link : CVE-2021-42143

Mitre link : CVE-2021-42143

CVE.ORG link : CVE-2021-42143

JSON object : View

Products Affected

contiki-ng

tinydtls

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2021-42143", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2024-01-24T18:15:08.080", "references": [{"url": "https://seclists.org/fulldisclosure/2024/Jan/16", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2024/Jan/16", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/fulldisclosure/2024/Jan/16", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Contiki-NG tinyDTLS a trav\u00e9s de la rama maestra 53a0d97. Existe un error de bucle infinito durante el manejo de un mensaje de protocolo de enlace ClientHello. Este error permite a atacantes remotos provocar una denegaci\u00f3n de servicio enviando un mensaje de protocolo de enlace ClientHello mal formado con una longitud impar de conjuntos de cifrado, lo que desencadena un bucle infinito (consumiendo todos los recursos) y una sobrelectura del b\u00fafer que puede revelar informaci\u00f3n confidencial."}], "lastModified": "2024-11-21T06:27:21.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:contiki-ng:tinydtls:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E938DF84-2663-4516-87E3-B7E46789F6A1", "versionEndIncluding": "2018-08-30"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}