buglwIP - A Lightweight TCP/IP stack - Bugs: bug #58554, Memory disclosure in the 6LoWPAN...


You are not allowed to post comments on this tracker with your current authentication level.

bug #58554: Memory disclosure in the 6LoWPAN implementation

Submitter:  Wenqiang Li <silentdawn>
Submitted:  Fri 12 Jun 2020 05:24:21 PM UTC
Category:  Security-related Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  yarrick
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Fri 03 Jul 2020 04:57:57 PM UTC, comment #1: 
Erik Ekman <yarrick>
Group Member
Fri 12 Jun 2020 05:24:21 PM UTC, original submission:  

Buffer overflow

This bug is similar to bug #58553. The function zepif_linkoutput() tries to parse an 6LoWPAN TX packet as UDP broadcast. When it calls the function pbuf_take_at() as shown in line 204 of zepif.c, the same incorrectly used parameters are passed as the Bug 2. In particular, the p->tot_len is the total length of the p->payload and all payloads length of its following pbuf. If p->tot_len is larger than the length of p->payload, the memory will leak to remote attackers through the network. To send the whole packet, it should use a loop to traverse the list of p->next and send all the payloads with length p->tot_len.

zepif_linkoutput(struct netif *netif, struct pbuf *p){

err = pbuf_take_at(q, p->payload, p->tot_len, sizeof(struct zep_hdr));


Memory disclosure.

Wenqiang Li <silentdawn>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by silentdawn (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.




    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-07-03 yarrick StatusNone Fixed
        Assigned toNone yarrick
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.11