Executive brief
Contiki-NG is an operating system for IoT devices that includes a DNS and multicast DNS resolver. A bug in the DNS name parsing logic fails to validate packet boundaries before reading DNS wire-format labels, allowing an attacker to read memory beyond the packet buffer. On multicast DNS configurations, any local network peer can trigger this without authentication; on standard DNS, an attacker injecting forged DNS responses can exploit it. This can disclose sensitive memory contents or crash the resolver, disrupting network connectivity.
Technical details
The vulnerability is a missing bounds check in the skip_name() function in os/services/resolv/resolv.c. The DNS name parsing code walks DNS wire-format name labels without validating that the pointer remains within the packet buffer, and the caller newdata() invokes skip_name() in a loop nquestions times based on an attacker-controlled DNS header field before validating the transaction ID. When nquestions exceeds the number of complete questions present, skip_name() reads past the UDP packet buffer (uip_buf), and the out-of-bounds pointer is cast to struct dns_answer * for further reads. On MDNS-enabled builds, any peer on the local network segment can trigger this via multicast UDP 5353 without an outstanding query; standard DNS builds require an attacker who can inject UDP responses from port 53 during an outstanding query. Impact includes out-of-bounds memory reads disclosing uip_buf and adjacent memory, or denial of service via resolver crash. A fix adding proper bounds checking was committed on 2026-07-08.
Affected products
- Contiki-NG Contiki-NG prior to commit 04a3f0a (2026-07-08)
Timeline
- 2026-08-06: disclosed
- 2026-07-08: patched: Merge of bounds-checking fix in commit 04a3f0a