Description

Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:18:10.590Z",
  "pubdate": "2026-08-06T22:18:10.590Z",
  "executiveSummary": "A buffer over-read vulnerability exists in the LwM2M TLV parser function lwm2m_tlv_read() located within os/services/lwm2m/lwm2m-tlv.c in Contiki-NG. The vulnerability is classified as an out-of-bounds read caused by a failure to validate caller-supplied buffer length arguments against the actual number of bytes read.\nThe impact of this vulnerability includes the unauthorized disclosure of sensitive heap memory contents, such as cryptographic key material and peer addresses, which are leaked through the parsed tlv->id, tlv->length, and tlv->value fields. Furthermore, the out-of-bounds memory values can corrupt the tlv_len variable, leading to further corruption of the caller's parse offset in lwm2m-engine.c.\nThe affected product is Contiki-NG, specifically within its LwM2M implementation. The risk implications are severe for constrained IoT devices operating in LwM2M NoSec mode, where no authentication is required by default, allowing network-adjacent or remote attackers to extract sensitive memory contents without credentials.\nExploitation requires an attacker to send a crafted CoAP WRITE request to any LwM2M endpoint where the final TLV supplies exactly one byte, triggering the out-of-bounds read condition during the iterative parsing process.",
  "technicalDetails": "The vulnerability resides in the lwm2m_tlv_read() function within os/services/lwm2m/lwm2m-tlv.c. The root cause of the flaw is that the function completely ignores its caller-supplied buffer length argument. Instead of enforcing bounds checking, it unconditionally attempts to read up to six bytes from the input buffer.\nThe vulnerable execution flow begins in lwm2m-engine.c, which invokes the TLV parsing logic while iterating as long as there is at least one byte remaining in the input buffer. An attacker can exploit this behavior by sending a crafted CoAP WRITE request to an LwM2M endpoint, engineered such that the final TLV supplies precisely one byte. This condition bypasses expected size constraints and triggers the underlying lwm2m_tlv_read() routine to execute multiple out-of-bounds reads.\nBecause bounds checking is omitted, the parser reads up to five bytes of adjacent heap memory located immediately after the valid CoAP input buffer. These leaked memory bytes are subsequently processed and exposed back to the requester through the parsed tlv->id, tlv->length, and tlv->value fields embedded in application responses or side-effects.\nIn addition to information disclosure, the reading of arbitrary adjacent heap memory causes the derived tlv_len to become corrupted. This corrupted length value propagates back to the caller in lwm2m-engine.c, disrupting the internal parse offset calculations and potentially leading to further memory corruption or unpredictable control flow anomalies.\nRegarding environmental exposure and access requirements, the vulnerability can be triggered across the network via CoAP WRITE operations. In deployments utilizing LwM2M NoSec mode—which represents the default configuration for many resource-constrained IoT devices—no authentication is required to interact with the endpoint. Consequently, unauthenticated remote attackers can execute the attack payload without holding any prior privileges or keys."
}