CF_CFDP_R_ProcessFd does not bound received FD PDU offset against the declared transaction file size

Aperta
  • Qualcosa non va?
#520 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

@0xiviel ci sta già lavorando.

Dal 28/9/2026.

  • #526 di @0xiviel — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
74/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c
Ambito
networking, security

Direzione di ricerca

Iniziare in fsw/src/cf_cfdp_r.c, da CF_CFDP_R_ProcessFd(), quindi confrontare il limite sul lato mittente in fsw/src/cf_cfdp_s.c:302. Riprodurre il trasferimento di quattro PDU descritto nell'issue e ispezionare il file risultante e i contatori HK. Il lavoro è completato quando un FD PDU fuori dai limiti viene rifiutato, file_size_mismatch viene incrementato e il trasferimento non viene segnalato come conservato correttamente.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Checklist (Please check before submitting)

  • I reviewed the Contributing Guide.
  • I performed a cursory search to see if the bug report is relevant, not redundant, nor in conflict with other tickets.

Describe the bug

CF_CFDP_R_ProcessFd() never compares fd->offset against txn->fsize. A CFDP file arrives as data, not as a command, so its offsets are attacker-controlled regardless of who is authorized to send commands.

Four FD PDUs totalling 82 bytes, 12 of them crafted, cause the receiver to write and retain a 4 GiB file for a transfer declared as 4 bytes. The transaction is reported as successful: files_recv increments, file_size_mismatch stays at 0, and the file is recorded as successfully retained.

The impact is storage exhaustion plus loss of file-length integrity, and a success report for a transfer that did not succeed. This is not a memory-safety defect; there is no sanitizer report because there is nothing for a sanitizer to catch.

The same application already enforces this bound on the sending side (cf_cfdp_s.c:302), and the file_size_mismatch counter exists for exactly this condition, but it is never reached on the receive path.

To Reproduce

  1. Start a CFDP receive transaction declaring a 4-byte file size.
  2. Send four FD PDUs, 82 bytes total. The crafted 12 bytes place a later PDU's offset beyond the declared size.
  3. Observe the resulting file on the receiving filesystem: 4 GiB.
  4. Observe the HK counters: files_recv=+1, file_size_mismatch=+0, transaction closed as successfully retained.

A/B isolation: the identical transfer without the crafted PDU produces a 4-byte file.

PoC, crafted PDUs and captured counter output: https://gist.github.com/iiviel/019284efadec361200a7902416f88108

Expected behavior

An FD PDU whose offset + data length exceeds txn->fsize is rejected and file_size_mismatch is incremented, applying the same bound the sender already uses at cf_cfdp_s.c:302.

Code snips

fsw/src/cf_cfdp_r.c, CF_CFDP_R_ProcessFd(): no comparison of fd->offset against txn->fsize on any path.

Sender-side bound for contrast: fsw/src/cf_cfdp_s.c:302.

System observed on:

  • Hardware: x86-64 and 32-bit builds
  • OS: Linux
  • Versions: CF v7.0.1, v7.0.0, v3.0.0, 2.2.1, reproduced on all four, on every CF branch, under CFDP class 1 and class 2, at both word sizes

Additional context

CF#499 finding 1 is in the same function but concerns a different defect with a different proposed remedy. This report is independent of it.

Reporter Info

Eva Crystal (0xiviel), XSource Security

Lingua principale
C
Stelle
122
Fork
79
Merge medio
1g 15h
PR unite (30g)
4

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nasa/CF

Tutte le issue di nasa/CF

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.