Impact

RIOT-OS contains a network stack with the ability to process 6LoWPAN frames. An attacker can send multiple crafted frames to the device to trigger a race condition. The race condition invalidates assumptions about the program state and leads to an invalid memory access resulting in denial of service.

Patches

None

Workarounds

• None

For more information

If you have any questions or comments about this advisory:

• Open an issue in RIOT
• Email us at RIOT-security

Bug Details

Triggering this bug requires a specific series of events. The following will describe what happens in chronological order.

1. A 6LoWPAN SFR fragment is send by calling gnrc_sixlowpan_frag_sfr_send. The fragment requires an ACK and thus _sched_arq_timeout is called (source):

   if (_frag_ack_req(frag_desc)) {
       ...
       _sched_arq_timeout(fbuf, fbuf->sfr.arq_timeout);
   }
   

2. The timeout expires and the corresponding event function _evtimer_msg_handler is called. The handler sends a message to the 6LoWPAN thread to inform it about the expired timer.
3. The 6LoWPAN thread is still processing another packet. During this processing the timer on fragment buffer is set again, e.g., because the fragment is resend.
4. The message from 2. is now processed by the 6LoWPAN thread. In gnrc_sixlowpan_frag_sfr_arq_timeout the event content pointer is set to NULL without checking if the timer is currently in use (source):

   fbuf->sfr.arq_timeout_event.msg.content.ptr = NULL;
   

5. In the end the timer can be scheduled again (source):

   if (reschedule_arq_timeout) {
       _sched_arq_timeout(fbuf, next_arq_offset);
       return;
   }
   

6. The check to assure that the timer is not already scheduled is now ineffective as it depends on the event content pointer (source):

   if (fbuf->sfr.arq_timeout_event.msg.content.ptr != NULL) {
       DEBUG("6lo sfr: ARQ timeout for datagram %u already scheduled\n",
             (uint8_t)fbuf->tag);
       return;
   }
   

The timer is thus scheduled two times which creates two problems:

1. The next pointer of the event points to itself creating an infinite loop once the timeout expires.
2. The event function modifies the event object on the first call and creates an invalid memory access in the second call.