CVE-2022-35927

    Dashboard / Vulnerabilities / CVE-2022-35927

    CVE-2022-35927

    Published: 4 Aug 2022Last Modified: 12 Aug 2026

    Summary: Unverified DIO prefix info lengths in RPL-Classic in Contiki-NG

    Details: Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating system, an incoming DODAG Information Option (DIO) control message can contain a prefix information option with a length parameter. The value of the length parameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_from_prefix function. This vulnerability affects anyone running a Contiki-NG version prior to 4.7 that can receive RPL DIO messages from external parties. To obtain a patched version, users should upgrade to Contiki-NG 4.7 or later. There are no workarounds for this issue.

    References: https://github.com/contiki-ng/contiki-ng/pull/1589/commits/4fffab0e632c4d01910fa957d1fd9ef321eb87d2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35927.json, https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9rm9-3phh-p4wm, https://nvd.nist.gov/vuln/detail/CVE-2022-35927, https://github.com/contiki-ng/contiki-ng/pull/1589

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a5313885d44c496ef0f5b8a689c84840e0f9e3fd

    Affected versions

    release/v4.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-35927 | CVE-DB