Open uttamsingh-kritikal opened 1 month ago
In this project, v6.2.0 of NetX Duo is being used.
As per NIST, the version 6.2.0 is outdated and vulnerable. We should use 6.3.0 or newer. But in STM32CubeIDE, only version 6.2.0 is available.
https://nvd.nist.gov/vuln/detail/CVE-2023-48692#range-12992536
I am writing to seek assistance regarding issues I am encountering with my project, specifically in connecting to an Access Point using the combination of CYW4373 (Type 2BC), STM32L4, ThreadX(2.0.0), netXduo(6.2.0) and Wi-Fi stack given by Murata.
We're experiencing issues with the DHCP client. We've found workarounds that seems to be effective, but we want to confirm that it's safe to use.
Bug 1/2 Not able to get IP. Root Cause: 24-byte difference in packet length compared to expected length.
Workaround We've discovered a 24-byte difference, so we added an extra 24 bytes to the NX_IPv4_PACKET length, and this appears to be working.
Bug 2/2 Not able to get IP (if DHCP offer packet have extra padding bytes). 24-byte difference in packet length compared to expected length.
Due to the extra padding bytes in the OFFER message, the DHCP client was failing the check and consequently releasing the DHCP offer packet.
Workaround Commented out the length check, and now it’s processing the DHCP packets and successfully obtaining the IP address.