SWM341 CAN Buffer Overflow Vulnerability Analysis

Vulnerability Overview Vulnerability Title: SWM341 CAN Receive Path Trusts Raw DLC and Writes Beyond Fixed Receive Buffer Vulnerability Description: The SWM341 CAN receive path copies the raw hardware DLC value into an 8-byte CAN receive buffer without restricting it to the classic CAN payload size. The external input boundary is the CAN controller's frame reception. When a frame arrives from the CAN bus, the controller exposes controlled frame metadata and payload via and . The lower 4 bits of are used as the DLC. This external DLC value is directly fed into a loop, causing out-of-bounds writes when the value exceeds 8. Impact Scope Potential Memory Corruption: Occurs from externally provided CAN frames when the CAN driver on the SWM341 board is enabled. Attacker-Controlled Values: If the controller reports a DLC value of 9-15 to the software, the driver first writes beyond the local buffer and may also write beyond within the RT-Thread receive callback. RTOS Deployment: As CAN traffic frequently crosses trust boundaries, the path is vulnerable where execution proceeds from interrupt-driven receive streams. Remediation Validate DLC: The DLC should be validated before being used as the copy length. For classic CAN, the code should reject/discard frames with a DLC value greater than 8, or limit the payload length to 8 before copying to . Code Example: Other Invariants: The same invariants should be preserved when writing before and before copying to . POC Code Relevant Log Output Environment Initial RT-Thread Commit: c39e074c1 Version: 5.2.2 Affected Driver: bsp/symlink/libraries/SWM341_drivers/drv_can.c Affected Low-Level CAN Code: bsp/symlink/libraries/SWM341_CSL/SWM341_StdPeriph_Driver/SWM341_can.c Affected Board: Symlink SWM341 Target Hardware: Not tested on-board Verification: Host-side AddressSanitizer semantic check Additional Context No Response: No additional context.

Goal Reached Thanks to every supporter — we hit 100%!

SWM341 CAN Buffer Overflow Vulnerability Analysis

More from this source