Apache NuttX is a free and open-source (FOSS) real-time operating system (RTOS) with an emphasis on standards compliance and small footprint. Scalable from 8-bit to 64-bit microcontroller environments, the primary governing standards in NuttX are POSIX and ANSI standards. Additional standard APIs from Unix and other common RTOS's (such as VxWorks) are adopted for functionality not available under these standards, or for functionality that is not appropriate for deeply-embedded environments (such as fork()).
Apache NuttX RTOS contains an out-of-bounds write in the 6LoWPAN RFC 6282 (IPHC/HC06) header decompressor in net/sixlowpan/sixlowpan_hc06.c. The HC06 compressor guards all UDP handling with #ifdef CONFIG_NET_UDP, but the decompressor sixlowpan_uncompresshdr_hc06() has no such guard: its UDP-NHC (next-header compression) reconstruction is compiled unconditionally and writes a reconstructed UDP header at the fixed offset bptr + IPv6_HDRLEN (the destination buffer start + 40 bytes). For a subsequent-fragment (FRAGN) frame, net/sixlowpan/sixlowpan_input.c sets that destination to the static buffer g_bitbucket, whose size UNCOMP_MAXHDR is derived from the configured transport protocols (IPv6_HDRLEN + TCP/UDP/ICMPv6 header length, or IPv6_HDRLEN alone when none is enabled). Because NET_6LOWPAN depends only on NET_IPv6 and HC06 has no UDP dependency in Kconfig, a build may enable HC06 while leaving UDP and TCP disabled; UNCOMP_MAXHDR is then 44 bytes (ICMPv6 only) or 40 bytes (none), smaller than the 48 bytes the UDP-header write requires.
An on-link attacker on the 802.15.4 / packet-radio network (no authentication) sends a valid first fragment (FRAG1) to allocate the reassembly state, then a crafted subsequent fragment (FRAGN) whose continuation bytes form an IPHC dispatch with the next-header-compressed bit set and a UDP-NHC pattern. The decompressor runs against g_bitbucket and writes the attacker-controlled UDP source/destination ports and checksum 2 to 6 bytes past the end of the static buffer, corrupting adjacent kernel .bss memory. This can result is memory corruption and a likely crash (denial of service).