FreeRTOS-Plus-TCP Buffer Over-Read Vulnerability in IPv6 Packet Processing

A buffer over-read vulnerability has been identified in FreeRTOS-Plus-TCP's IPv6 packet processing. This issue arises from a missing validation check that allows improper payload lengths in IPv6 packets to cause out-of-bounds read operations. The vulnerability affects FreeRTOS-Plus-TCP versions 4.0.0 prior to 4.3.3, when IPv6 support is enabled.

Impact

Exploitation of this vulnerability leads to a buffer over-read, where the application reads data beyond the allocated memory buffer, potentially causing memory corruption or leaking sensitive information.

Remediation

Users are advised to upgrade to FreeRTOS-Plus-TCP version 4.3.4, which addresses this vulnerability. For those using forked or derivative versions, ensure to incorporate the latest fixes.