| Titolo | NASA cFS 7.0.1 Memory Corruption |
|---|
| Descrizione |
**Submission title**
> cFS 7.0.1 SBN TCP: attacker-controlled 32-bit MsgSz drives OS_read into fixed per-peer buffer before validation (memory corruption)
**Technical severity (VRT)**
> VRT Category: Server-Side Injection > Buffer Overflow
> Suggested priority: P2 — High (adjacent-network, RCE-class)
**URL / Location of vulnerability**
> nasa/SBN (cFS 7.0.1 SBN TCP module) — `modules/protocol/tcp/fsw/src/sbn_tcp_if.c:488-491`
**Description** (≤ 25,000 chars)
### Summary / Impact
cFS `v7.0.1` includes SBN `v7.0.1`. In the SBN TCP protocol module, `Recv()` reads a fixed SBN header into `RecvBufs`, calculates the body read length from the packet-controlled 32-bit `SBN_MsgSz_t` field, and calls `OS_read()` with that untrusted length before `SBN.UnpackMsg()` rejects messages larger than `CFE_MISSION_SB_MAX_SB_MSG_SIZE`.
A reachable SBN TCP peer can send a packed SBN header with `MsgSz=0x00010000`. The TCP receive path then computes `ToRead=65536` while each per-peer receive row is `SBN_PACKED_HDR_SZ + CFE_MISSION_SB_MAX_SB_MSG_SIZE` = 32781 bytes. Because the body read starts at offset 13, a full body can overwrite adjacent receive rows and, for the last peer row, overflow the global `RecvBufs` object before the later semantic size validation runs. This is an adjacent-network memory-corruption/DoS candidate with RCE-class impact potential in hardened builds only if exploitability is separately demonstrated; this package does not include weaponized RCE or LPE.
---
### Affected component
- Project: NASA core Flight System (cFS) 7.0.1 distribution
- Component: nasa/SBN (cFS 7.0.1 SBN TCP module)
- Vulnerable location: `modules/protocol/tcp/fsw/src/sbn_tcp_if.c:488-491`
- Status: unpatched in the affected version at time of report.
### Vulnerability details
- Root cause: packet-derived SBN TCP body length is trusted by the transport receive path before semantic unpack validation.
- Memory sink: `OS_read(Conn->Socket, (char *)&RecvBufs[Conn->BufNum] + Conn->RecvSz, ToRead)`.
- Trigger field: packed SBN TCP header `MsgSz`, typed as `uint32`.
- Affected release state: cFS `v7.0.1` with SBN `v7.0.1` submodule.
- Duplicate status: web, GitHub issue, and NVD searches on 2026-06-05 found no exact public SBN TCP `CFE_MAKE_BIG32` / `RecvBufs` duplicate. Public cFS CVE-2026-5474/5475/5476 reports cover CCSDS/TO_LAB/CFE_SB/TBL paths, not SBN TCP pre-unpack receive buffers. The existing local NOS3 SBN package covers a separate NOS3-bundled signed-16-bit SBN TCP variant; this candidate is the cFS v7.0.1 SBN 32-bit mainline path.
Recommended fix: after the fixed SBN header is received but before reading the body, decode the length into a bounded integer and reject `MsgSz > CFE_MISSION_SB_MAX_SB_MSG_SIZE`; also assert `Conn->RecvSz + ToRead <= SBN_MAX_PACKED_MSG_SZ`.
### Proof of concept / replication steps
1. Use cFS `v7.0.1` and SBN submodule `3b7b37572d63c3f8e85b1f0fa95853c1b78dcf96`.
2. Inspect `apps/sbn/modules/protocol/tcp/fsw/src/sbn_tcp_if.c`: `RecvBufs` is declared as `SBN_MAX_PEER_CNT` rows of `SBN_MAX_PACKED_MSG_SZ`.
3. Inspect the TCP receive body path: `ToRead` is calculated from the raw packed header with `CFE_MAKE_BIG32(*((SBN_MsgSz_t *)&RecvBufs[Conn->BufNum])) + SBN_PACKED_HDR_SZ - Conn->RecvSz` and passed to `OS_read()` before `SBN.UnpackMsg()`.
4. Inspect `apps/sbn/fsw/src/sbn_app.c`: `SBN_UnpackMsg()` rejects oversized `MsgSz`, but this happens after the TCP body has already been read into `RecvBufs`.
5. Run the safe source-chain model:
```bash
python3 submission_packages/CAND-CFS-SBN-TCP-U32-MSGSZ-RECVBUF-BOF/poc.py \
--json analysis/reports/rce_lpe/cfs_sbn_tcp_u32_msgsz_recvbuf_bof_20260611.json \
--log submission_packages/CAND-CFS-SBN-TCP-U32-MSGSZ-RECVBUF-BOF/crash_evidence.log \
--expect-crash
```
Optional local ASAN fixture:
```bash
bash scripts/run_cfs_sbn_asan_refresh_20260611.sh
```
The included `poc.py` does not open sockets or attack a live target. It verifies the source anchors and models the exact prevalidation arithmetic for `wire MsgSz=0x00010000`, `Conn->RecvSz=SBN_PACKED_HDR_SZ`, and `Conn->BufNum=SBN_MAX_PEER_CNT - 1`.
The generated evidence shows:
- `to_read_before_unpack_validation=65536`
- `per_peer_recvbuf_size=32781`
- `modeled_row_clobber_bytes=32768`
- `modeled_global_clobber_bytes=32768`
- `would_be_rejected_after_read=true`
- `asan_global_buffer_overflow_confirmed=true` in `analysis/reports/rce_lpe/cfs_sbn_tcp_u32_msgsz_recvbuf_bof_asan_20260611.json`
=================================================================
==10315==ERROR: AddressSanitizer: global-buffer-overflow on address 0x64a0e39592b0 at pc 0x7eb3724fb303 bp 0x7ffdde36dfc0 sp 0x7ffdde36d768
WRITE of size 65536 at 0x64a0e39592b0 thread T0
#0 0x7eb3724fb302 in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
#1 0x64a0e38d63fa in main submission_packages/CAND-CFS-SBN-TCP-U32-MSGSZ-RECVBUF-BOF/asan_fixture.c:33
#2 0x7eb37202a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#3 0x7eb37202a28a in __libc_start_main_impl ../csu/libc-start.c:360
#4 0x64a0e38d61e4 in _start (/mnt/c/Users/JUN/Desktop/target/nasa/analysis/reports/rce_lpe/cfs_sbn_tcp_u32_msgsz_recvbuf_bof_asan_20260621_harness+0x11e4) (BuildId: ec097c696a354322e355981631a57022f7be1953)
0x64a0e39592b0 is located 0 bytes after global variable 'RecvBufs' defined in 'submission_packages/CAND-CFS-SBN-TCP-U32-MSGSZ-RECVBUF-BOF/asan_fixture.c:11:16' (0x64a0e38d91e0) of size 524496
SUMMARY: AddressSanitizer: global-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy
Shadow bytes around the buggy address:
0x64a0e3959000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x64a0e3959080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x64a0e3959100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x64a0e3959180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x64a0e3959200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x64a0e3959280: 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9 00 00 00 00
0x64a0e3959300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x64a0e3959380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x64a0e3959400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x64a0e3959480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x64a0e3959500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==10315==ABORTING
|
|---|
| Fonte | ⚠️ https://github.com/nasa/cFS |
|---|
| Utente | juntheworld (UID 99760) |
|---|
| Sottomissione | 13/07/2026 16:09 (2 mesi fa) |
|---|
| Moderazione | 29/08/2026 16:40 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 397029 [NASA cFS fino a 7.0.1 SBN TCP sbn_tcp_if.c OS_read MsgSz buffer overflow] |
|---|
| Punti | 19 |
|---|