CVE-2021-42143

Published: Jan 24, 2024Modified: Jun 20, 2025

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.

Affected (1)

Products: Contiki Ng: Tinydtls

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Contiki Ng Tinydtls	Up to 2018-08-30

Related CWEs

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (3)

https://seclists.org/fulldisclosure/2024/Jan/16

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2024/Jan/16

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/fulldisclosure/2024/Jan/16

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.