1-byte Heap OOB Read in asn1c INTEGER_decode_oer (CWE-125)

Vulnerability Overview Vulnerability Name: 1-byte Heap Out-of-Bounds Read in via Malformed OER Payload Vulnerability Type: Primary: CWE-125: Out-of-bounds Read Secondary: CWE-130: Improper Handling of Length Parameter Inconsistency Secondary: CWE-20: Improper Input Validation Affected Versions: Original Upstream (v1a/asn1c): Latest master branch (v0.9.28, commit 9925dbda4b6d430895108439ea3b31280a9605) Active Fork (mouse7418/asn1c): Latest branch (v1.4, commit c494662a29934d592a4882906560e2489e736) Description: When parsing a maliciously crafted zero-length OER payload, the decoder fails to validate the required number of bytes, resulting in a 1-byte heap out-of-bounds read. This vulnerability primarily affects decoders generated by asn1c, such as those used in V2X network protocols, GSM call headers, or X.509 certificates. Impact Scope Supply Chain Impact: Since asn1c copies the decoder skeleton directly into the generated source code, downstream applications may inherit this vulnerability during the code generation process. Even without dynamic linking, the vulnerable decoding logic may persist in long-lived branches, embedded firmware, telecom stacks, and vehicle communication systems. Affected Pattern Characteristics: ASN.1 patterns defining INTEGER types with variable length constraints and a non-negative lower bound. Examples include: - INTEGER (0..MAX) - INTEGER (0..18446744073709551615) - Unsigned counters or sequence numbers - Non-negative protocol identifiers (such as PSIDs in IEEE 1609.2) Real-World Impact: This vulnerability has been proven to have severe consequences for downstream production systems. For example, in Vanetta (an open-source V2X protocol stack), this vulnerability was exploited as the root cause for remote DoS and state poisoning attacks. Remediation Recommended Fix: Implement strict validation checks in to ensure the required number of bytes is validated before extracting the MSB. Proposed Patch: Important Note: Since asn1c supports multiple encoding rules (BER, DER, UPER, etc.) and complex patterns, modifying the core INTEGER decoding logic may introduce unexpected side effects. Therefore, comprehensive regression testing across all supported encoding rules is strongly recommended before merging. Proof of Concept Design Strategy Minimal Pattern: Proof 1: Memory Safety Violation via ASAN (poc_asan.c): Proof 2: Remote Denial of Service via Page Boundary (poc_dos.c): Reproduction Steps Step 1: Generate Decoder Skeleton Step 2: Observe ASAN Heap-Buffer-Overflow Step 3: Observe Guaranteed Segmentation Fault Attachments poc.asn1 poc_asan.c poc_dos.c poc.zip Acknowledgments This vulnerability was discovered by Y-Huang Lu under the supervision of Prof. Rafael Kaliski, as part of the Network Protocol and Resource Optimization Design Lab (NETPROD) at National Sun Yat-sen University (NSYSU), Taiwan.

Goal Reached Thanks to every supporter — we hit 100%!

1-byte Heap OOB Read in asn1c INTEGER_decode_oer (CWE-125)

More from this source