CVE-2025-66646: 
NixOS vulnerability analysis and mitigation

CVE-2025-66646 is a NULL pointer dereference vulnerability in the IPv6 fragmentation reassembly implementation (gnrc_ipv6_ext_frag_reass) of RIOT OS. When a fragmented IPv6 packet with fragment offset 0 and an empty payload is received, the payload pointer (pkt->data) is set to NULL by gnrc_pktbuf_mark, but the implementation proceeds to attempt a memcpy into the reassembly buffer using that NULL pointer, crashing the OS. Affected versions are all RIOT OS releases prior to v2025.10, including v2025.07 and the v2025.10 release candidates (rc1, rc2, rc3). The vulnerability was disclosed on December 17, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (RIOT-OS Advisory, Feedly).

The root cause is a missing NULL/empty-payload check in gnrc_ipv6_ext_frag_reass (CWE-476: NULL Pointer Dereference), located in sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c. An attacker crafts an IPv6 packet with the payload length field set to 8 (exactly the size of the fragmentation header) and fragment offset 0; after gnrc_pktbuf_mark strips the fragmentation header, pkt->size becomes 0 and pkt->data is set to NULL. Because no size-zero check exists after this call, the invalid packet is stored as the reassembly buffer entry (rbuf->pkt). When a second packet with the same fragment ID and offset 0 (but a valid payload) arrives, the implementation executes memcpy(rbuf->pkt->data, ...) — a write through a NULL pointer — causing an immediate crash. The fix adds a pkt->size == 0 check immediately after the gnrc_pktbuf_mark call to reject empty fragments early (RIOT-OS Advisory, Source Code).

Successful exploitation causes an immediate, complete denial of service (DoS) by crashing the RIOT OS firmware on the target device. The impact is limited to availability — there is no confidentiality or integrity compromise, and no code execution beyond the crash is possible. Because RIOT OS targets resource-constrained IoT and embedded devices, a crash renders the device non-responsive until manually rebooted, which may be operationally significant in industrial, sensor, or critical infrastructure deployments. The attack requires no authentication or user interaction and can be launched remotely over any IPv6-reachable network path (RIOT-OS Advisory).

A public proof-of-concept reproducer (exploit script and example application) is available on GitHub, published alongside the advisory (PoC Reproducer, RIOT-OS Advisory). The exploit requires sending only two specially crafted IPv6 packets and has low attack complexity with no privileges or user interaction required. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.000850 (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Prerequisite verification: Confirm the target device runs RIOT OS prior to v2025.10 with the gnrc_ipv6_ext_frag module enabled, and that the attacker has IPv6 network reachability to the device.
2. Obtain the target's IPv6 address: Discover the link-local or global IPv6 address of the target device (e.g., via network scanning or device enumeration).
3. Craft Packet 1 (empty payload fragment): Send an IPv6 packet to the target with:
   • plen = 8 (payload length equals exactly the fragmentation header size)
   • A fragmentation extension header with offset = 0 and the More Fragments (M) bit set
   • A chosen fragment ID (e.g., 0xABCD)
   • No actual payload after the fragmentation header This causes gnrc_pktbuf_mark to set pkt->data = NULL and store the invalid packet as rbuf->pkt.
4. Craft Packet 2 (valid payload fragment): Send a second IPv6 packet with the same fragment ID, offset = 0, the M bit set, and a non-empty payload (e.g., 16 bytes of arbitrary data).
5. Trigger the crash: Upon receiving Packet 2, the reassembly code executes memcpy(rbuf->pkt->data, pkt->data, pkt->size) where rbuf->pkt->data is NULL, causing a NULL pointer dereference and immediate OS crash (segmentation fault in native/simulation, hard fault on hardware) (RIOT-OS Advisory, PoC Reproducer).

• Network: Two IPv6 packets with the same fragment ID arriving in rapid succession, where the first has plen=8 (empty payload after fragmentation header) and offset=0 with the M bit set; the second has offset=0, M bit set, and a non-empty payload. Unusual or malformed IPv6 fragmented traffic from an unexpected source to an IoT device.
• Device Behavior: Sudden, unexpected device reboot or unresponsiveness immediately following receipt of IPv6 fragmented packets; loss of connectivity to the device without prior warning.
• Logs: If debug logging is enabled in RIOT OS, absence of expected log output after the fragmentation reassembly path is entered; crash dump or hard fault log entries on supported hardware platforms.

Upgrade RIOT OS to version v2025.10 or later, which includes the fix that adds a pkt->size == 0 check after gnrc_pktbuf_mark to reject empty fragments before any pointer dereference occurs (RIOT-OS Advisory, RIOT-OS Release). For devices that cannot be immediately patched, disable the gnrc_ipv6_ext_frag module in the build configuration if IPv6 fragmentation reassembly is not operationally required. As an additional network-level control, deploy firewall or router ACLs to block IPv6 fragmented packets from untrusted sources from reaching vulnerable devices.

The vulnerability was reported by security researcher Nils Bernsdorf and published via the RIOT-OS GitHub Security Advisory program on December 17, 2025. The advisory was picked up by standard vulnerability tracking services (Vulners, CVEFeed, CIRCL Vulnerability Lookup) shortly after disclosure. No significant broader media coverage or notable community controversy has been identified beyond routine vulnerability database indexing (RIOT-OS Advisory).