Summary
I spotted a buffer overflow vulnerability at the following location in the Zephyr CANbus subsystem source code:
https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/canbus/isotp/isotp.c
Details
Ineffective size check due to assert and stack-based buffer overflow in /subsys/canbus/isotp/isotp.c:
static inline int send_sf(struct isotp_send_ctx *ctx)
{
struct can_frame frame = {
.flags = ctx->tx_addr.ide != 0 ? CAN_FRAME_IDE : 0,
.id = ctx->tx_addr.ext_id
};
size_t len = get_ctx_data_length(ctx);
int index = 0;
int ret;
const uint8_t *data;
data = get_data_ctx(ctx);
pull_data_ctx(ctx, len);
if (ctx->tx_addr.use_ext_addr) {
frame.data[index++] = ctx->tx_addr.ext_addr;
}
frame.data[index++] = ISOTP_PCI_TYPE_SF | len;
__ASSERT_NO_MSG(len <= ISOTP_CAN_DL - index);
memcpy(&frame.data[index], data, len); /* VULN */
#ifdef CONFIG_ISOTP_ENABLE_TX_PADDING
/* AUTOSAR requirement SWS_CanTp_00348 */
memset(&frame.data[index + len], 0xCC, ISOTP_CAN_DL - len - index);
frame.dlc = ISOTP_CAN_DL;
#else
frame.dlc = len + index;
#endif
ctx->state = ISOTP_TX_SEND_SF;
ret = can_send(ctx->can_dev, &frame, K_MSEC(ISOTP_A),
send_can_tx_cb, ctx);
return ret;
}
PoC
I haven't tried to reproduce this potential vulnerability against a live install of the Zephyr OS.
Impact
If the unchecked input above is attacker-controlled and crosses a security boundary, the impact of the buffer overflow vulnerability could range from denial of service to arbitrary code execution.
Summary
I spotted a buffer overflow vulnerability at the following location in the Zephyr CANbus subsystem source code:
https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/canbus/isotp/isotp.c
Details
Ineffective size check due to assert and stack-based buffer overflow in /subsys/canbus/isotp/isotp.c:
PoC
I haven't tried to reproduce this potential vulnerability against a live install of the Zephyr OS.
Impact
If the unchecked input above is attacker-controlled and crosses a security boundary, the impact of the buffer overflow vulnerability could range from denial of service to arbitrary code execution.