| शीर्षक | MZ Automation libiec61850 1.6.1 Memory Corruption (heap-buffer-overflow) |
|---|
| विवरण | A vulnerability was identified in libiec61850 in the Sampled Values (SV) subscriber implementation on the v1.6_develop branch at commit 196bb76db9a560b92fc12284c10da7720920b164 and on the v1.6 branch (released version v1.6.1). The issue affects the SV receiving/subscriber side and can be triggered remotely by sending a crafted malformed SV Ethernet frame to a process using the library as an SV subscriber. The problem is reproducible with the official example program `sv_subscriber_example`, which demonstrates that the issue is not limited to a custom integration and is reachable through the library’s normal protocol handling path.
The root cause is an inconsistent trust model between ASN.1/BER field parsing and fixed-width field access. During SV ASDU parsing in `src/sampled_values/sv_subscriber.c`, the parser accepts the `confRev` element (tag `0x83`) and stores only a pointer to the field payload. However, it does not enforce the semantic requirement that `confRev` must be encoded as a 4-byte value, and it does not preserve the actual encoded length for later validation. As a result, a malformed frame can provide a `confRev` element with a shorter payload, for example a one-byte value. Later, the public getter `SVSubscriber_ASDU_getConfRev` unconditionally reads the field as a 32-bit integer and copies 4 bytes from the stored pointer. If the attacker positions the short `confRev` payload near the end of the packet receive buffer, the getter performs an out-of-bounds read past the heap allocation boundary.
The vulnerable execution path is a real protocol path: raw Ethernet SV frame -> `SVReceiver_tick` -> `parseSVMessage` -> `handleSVApdu` -> `parseSVPayload` -> `parseSequenceOfASDU` -> `parseASDU` -> subscriber callback -> `SVSubscriber_ASDU_getConfRev`. In the verified crash, AddressSanitizer reports a heap-buffer-overflow read in `memcpy_reverse`, called by `SVSubscriber_ASDU_getConfRev`. The faulting address is immediately to the right of the 1518-byte receive buffer allocated by `SVReceiver_create`, showing that the malformed SV frame causes the subscriber to read beyond the end of the heap-backed packet buffer.
This issue should be considered a library-level memory safety vulnerability rather than an application misuse issue. The affected getter is part of the public API, and the official subscriber example directly invokes it after receiving an ASDU. The caller is not required by the API contract to revalidate the raw BER element length before accessing `confRev`. Therefore, any application that uses libiec61850 in subscriber mode and relies on the normal API surface may inherit the same vulnerability.
The security impact is at least unauthenticated remote denial of service on the subscriber side within the attacker’s reachable Layer 2 SV network segment. A crafted malformed SV frame can cause the target subscriber process to abort under sanitizers and can lead to process crash or abnormal termination in non-sanitized builds as well. Because the bug is caused by out-of-bounds memory access in protocol-driven parsing state, the issue represents a genuine memory corruption class flaw in the subscriber implementation.
A complete fix should validate the semantic length of fixed-width SV fields such as `confRev` during parsing and reject malformed ASDUs before exposing them to callbacks or public getters. In addition, the internal ASDU representation should retain element lengths so that getters can safely verify the expected size before reading 2-byte, 4-byte, or 8-byte fields. This is important because the same design pattern may affect other fixed-width SV ASDU fields beyond `confRev`.
|
|---|
| स्रोत | ⚠️ https://github.com/mz-automation/libiec61850/issues/598 |
|---|
| उपयोगकर्ता | SCU_1CP (UID 99172) |
|---|
| सबमिशन | 21/06/2026 01:34 PM (2 महीनों पहले) |
|---|
| संयम | 07/08/2026 10:09 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 386950 [MZ Automation libiec61850 तक 1.6.1 ASDU Element sv_subscriber.c SVReceiver_stopThreadless बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|