[SECURITY] Missing length validation for CFE_ES_SEND_HK_MID in ES TaskPipe
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start in cfe/modules/es/fsw/src/cfe_es_dispatch.c at CFE_ES_TaskPipe(), and compare the SEND_HK_MID path with the other command paths in CFE_ES_ProcessGroundCmd(). Reproduce with a packet smaller than sizeof(CFE_ES_SendHkCmd_t); done means the message length is checked before the buffer is cast and truncated packets no longer reach the field accesses.
Written by the indexing model from the issue text.
Description
Describe the bug
CFE_ES_TaskPipe() processes SEND_HK_MID messages by directly casting the buffer to CFE_ES_SendHkCmd_t * without calling CFE_ES_VerifyCmdLength(). All other command codes in CFE_ES_ProcessGroundCmd() use VerifyCmdLength before casting. A malformed/truncated packet can cause OOB read when ES accesses the struct fields.
This is the same root cause as #971 (TIME DATA_CMD_MID missing length validation).
To Reproduce
- Send a
CFE_ES_SEND_HK_MIDpacket with size <sizeof(CFE_ES_SendHkCmd_t) - ES processes it without validation
- OOB read when fields are accessed
Expected behavior
CFE_ES_TaskPipe() should call CFE_ES_VerifyCmdLength(&SBBufPtr->Msg, sizeof(CFE_ES_SendHkCmd_t)) before casting.
Code snips
File: cfe/modules/es/fsw/src/cfe_es_dispatch.c, function CFE_ES_TaskPipe():
if (CFE_SB_MsgId_Equal(MessageID, SEND_HK_MID))
{
CFE_ES_SendHkCmd((const CFE_ES_SendHkCmd_t *)SBBufPtr); // بدون VerifyCmdLength!
}
Reporter Info
Erfan, Independent Space Software Security Researcher- Dominant language
- C
- Stars
- 1.5k
- Forks
- 391
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 19
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nasa/cFS
-
[SECURITY] Off-by-one bounds check in SBN HKPeerCmd/HKNetCmd allows access to invalid net/peer slots Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
continuous-integration
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
[SECURITY] Missing lower-bound validation in CI_LAB_DecodeInputMessage allows zero-length packets Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Similar issues
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
docs
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
P3 sonic-vpp
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sonic-net/sonic-buildimage#29662 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
spack/spack-packages#6586 ·
-
category:port-update
Difficulty 2/5 1-3 hours Newbie friendliness 72/100