CVE-2024-32017

The first vulnerability results from a typographical error in the `gcoap_dns_server_proxy_get()` function: the length of the `_uri` string is checked instead of the `_proxy` string, leading to buffer overflow during the subsequent `strcpy()` call. The second vulnerability affects the `_gcoap_forward_proxy_copy_options()` function, which does not verify the data size before copying it to the `cep->req_etag` buffer of fixed length `COAP_ETAG_LENGTH_MAX` bytes — if an attacker causes the `optlen` value to exceed this limit, a buffer overflow occurs (CWE-120). Both vulnerabilities can be triggered remotely through crafted input data exceeding the security boundary.

An attacker can cause denial of service (DoS) or execute arbitrary code (RCE) on a device running a vulnerable version of RIOT OS, potentially gaining full control over the embedded system.

At the time of publication, the vulnerability has not been patched by the vendor (no patch available). Manual addition of buffer bounds verification in the functions `gcoap_dns_server_proxy_get()` and `_gcoap_forward_proxy_copy_options()` is recommended. It is advisable to monitor the RIOT-OS repository and vendor advisory for the release of an official patch.

RIOT OS (Riot-Os RIOT) — all versions containing vulnerable code in files `sys/net/application_layer/gcoap/dns.c` and `sys/net/application_layer/gcoap/forward_proxy.c`; specific versions listed in vendor references