An integer underflow vulnerability in AWS FreeRTOS-Plus-TCP allows adjacent network attackers to cause a permanent device freeze via crafted DHCPv6 packets.

The vulnerability is an integer underflow (CWE-191) located in the DHCPv6 sub-option parser that is triggered when DHCPv6 is enabled. An unauthenticated attacker on an adjacent network can exploit this by sending a single crafted DHCPv6 packet to the device.

Successful exploitation results in the corruption of critical network settings, including IPv6 address assignment, DNS configuration, and lease times. Furthermore, the flaw can cause a permanent denial of service condition characterized by an IP task freeze, which necessitates a hardware reset. Given the CVSS score of 8.1, this represents a high risk to availability for embedded systems relying on FreeRTOS-Plus-TCP.

Immediate Action: Update AWS FreeRTOS-Plus-TCP to version 4.2.6, 4.4.1, or newer to resolve the integer underflow.

Proactive Monitoring: Monitor network traffic for malformed or unusually large DHCPv6 packets originating from unknown or unauthorized devices on the local network segment.

Compensating Controls: If patching is not immediately feasible, disable DHCPv6 functionality on the device if the environment allows for static IPv6 configuration as an alternative.

Public Exploit Available: Unknown.

This vulnerability poses a significant threat to the stability of embedded systems using the FreeRTOS-Plus-TCP stack. Because the attack vector is adjacent and does not require authentication, the risk of disruption is substantial. Administrators must prioritize updating to the patched versions provided by AWS to ensure device reliability and network integrity.