Contiki-NG tinyDTLS Buffer Over-Read / Denial Of Service

An issue was discovered in Contiki-NG tinyDTLS versions through 2018-08-30. A buffer over-read exists in the dtls_sha256_update function. This bug allows remote attackers to cause a denial of service (crash) and possibly read sensitive information by sending a malformed packet with an over-large fragment length field, due to servers incorrectly handling malformed packets.

attackers buffer bug crash denial of service function handling information issue large length malformed packet sensitive sensitive information servers service