CVE-2025-66647: 
NixOS vulnerability analysis and mitigation

CVE-2025-66647 is a classic buffer overflow vulnerability in the IPv6 fragmentation reassembly implementation (gnrc_ipv6_ext_frag_reass) of RIOT OS, an open-source IoT/embedded microcontroller operating system. The flaw was discovered and reported by Nils Bernsdorf and disclosed on December 17, 2025. It affects RIOT OS versions up to and including 2025.07 (and release candidates of 2025.10 prior to the final release). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-120 (Buffer Copy without Checking Size of Input — Classic Buffer Overflow) in the gnrc_ipv6_ext_frag_reass function within sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c. When the first IPv6 fragment (offset=0) is received, the implementation uses the incoming packet buffer directly as the reassembly buffer without allocating additional space. If a second, larger fragment with the same fragment ID and offset=0 arrives later, the code performs an unchecked memcpy into the undersized reassembly buffer — a bounds check present for fragments with offset>0 was omitted for the offset=0 case. Exploitation requires the gnrc_ipv6_ext_frag module to be compiled into the firmware and the attacker to be able to send arbitrary IPv6 packets to the target device (GitHub Advisory, Source Code).

Successful exploitation corrupts the metadata and data of packet buffers adjacent to the reassembly buffer in memory, most commonly causing an immediate OS crash (denial of service). However, by carefully manipulating packet buffer metadata such as data pointers, an attacker may achieve arbitrary memory writes, potentially leading to remote code execution on the affected IoT or embedded device. Given the constrained nature of RIOT OS targets (microcontrollers, IoT sensors, edge nodes), a compromised device could be used as a pivot point within an IoT network or to disrupt safety-critical operations (GitHub Advisory).

A proof-of-concept exploit script (exploit.py) and a reproducer application were included in the original security advisory, demonstrating the overflow via crafted IPv6 fragmented packets sent over a TAP interface. The exploit requires no authentication and no user interaction, and is executable by any network-adjacent attacker who can send IPv6 packets to the victim. The EPSS score is approximately 0.41%, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No in-the-wild exploitation or threat actor attribution has been reported (GitHub Advisory).

1. Identify target: Locate a RIOT OS device (version ≤2025.07) with the gnrc_ipv6_ext_frag module enabled and reachable over an IPv6 network (e.g., via link-local or global IPv6 address).
2. Craft first (small) fragment: Send an IPv6 packet with a Fragmentation Extension Header, fragment offset=0, More Fragments (M) bit set to 1, a chosen fragment ID (e.g., id=43981), and a small payload (e.g., 16 bytes of 'A'). This causes RIOT to use the small packet buffer as the reassembly buffer.
3. Craft second (large) fragment: Send a second IPv6 packet with the same fragment ID and offset=0, but with a significantly larger payload (e.g., 120 bytes of 'A'). The M bit should remain set.
4. Trigger overflow: When RIOT processes the second fragment, it detects an existing reassembly buffer and calls memcpy(rbuf->pkt->data, pkt->data, pkt->size) without checking if pkt->size exceeds rbuf->pkt->size, overflowing the small reassembly buffer into adjacent packet buffer memory.
5. Achieve DoS or RCE: The overflow corrupts adjacent gnrc_pktsnip_t metadata. In most cases this causes an OS crash (DoS). With careful payload crafting to manipulate the data pointer of adjacent buffers, arbitrary memory writes — and potentially remote code execution — may be achievable (GitHub Advisory).

• Network: Pairs of IPv6 packets with Fragmentation Extension Headers sharing the same fragment ID and both having offset=0, where the second packet is significantly larger than the first; unusual IPv6 fragmented traffic directed at IoT/embedded devices running RIOT OS.
• Device Behavior: Unexpected device resets or crashes (watchdog resets) on RIOT OS nodes shortly after receiving IPv6 fragmented traffic; loss of network connectivity from previously stable IoT nodes.
• Logs: RIOT OS debug output (if enabled) showing ipv6_ext_frag related messages such as reassembly buffer allocation or memcpy operations with mismatched sizes; assertion failures or hard faults in the network stack thread.

Upgrade to RIOT OS version 2025.10 (final release), which includes a bounds check added before the memcpy in gnrc_ipv6_ext_frag_reass that rejects fragments where the reassembly buffer is too small to hold the incoming first fragment. As a workaround for deployments that cannot immediately upgrade, disable or exclude the gnrc_ipv6_ext_frag module from the firmware build if IPv6 fragmentation reassembly is not required for the application. Network-level filtering of unexpected IPv6 fragmented traffic at border routers or gateways can also reduce exposure (GitHub Advisory, RIOT 2025.10 Release).

The vulnerability was published by the RIOT-OS security team on GitHub on December 17, 2025, crediting Nils Bernsdorf as the reporter. Red Hat tracked the issue under their CVE database. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified (GitHub Advisory, Red Hat CVE).