CVE-2024-53980 Information

Description

RIOT is an open-source microcontroller operating system designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A malicious actor can send a IEEE 802.15.4 packet with spoofed length byte and optionally spoofed FCS which eventually results into an endless loop on a CC2538 as receiver. Before PR 20998 the receiver would check for the location of the CRC bit using the packet length byte by considering all 8 bits instead of discarding bit 7 which is what the radio does. This then results into reading outside of the RX FIFO. Although it prints an error when attempting to read outside of the RX FIFO it will continue doing this. This may lead to a discrepancy in the CRC check according to the firmware and the radio. If the CPU judges the CRC as correct and the radio is set to AUTO_ACK when the packet requests and acknowledgment the CPU will go into the state CC2538_STATE_TX_ACK. However if the radio judged the CRC as incorrect it will not send an acknowledgment and thus the TXACKDONE event will not fire. It will then never return to the state CC2538_STATE_READY since the baseband processing is still disabled. Then the CPU will be in an endless loop. Since setting to idle is not forced it won’t do it if the radio’s state is not CC2538_STATE_READY. A fix has not yet been made.

Reference

https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L183 https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L417 https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L419 https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L421-L422 https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/sys/net/link_layer/ieee802154/submac.c#L149 https://github.com/RIOT-OS/RIOT/pull/20998 https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-m75q-8vj8-wppw