OpENer Integer Overflow Leading to Stack Buffer Overflow in CIP Message Router

Vulnerability Overview Vulnerability Name: Integer Overflow and Truncation Leading to Stack Buffer Overflow in CIP Message Router #563 Vulnerability Description: Vulnerability Type: Integer overflow and truncation leading to a stack buffer overflow. Affected Software: OpENer 2.3.0 (commit 76695cf) Root Cause: During the processing of Common Industrial Protocol (CIP) network packets, length parameters are inconsistently typed, leading to integer overflow and truncation. Specifically: - Type Truncation: In the function, the parameter is truncated to a negative value. - Integer Overflow: In the file, an unsigned shift operation results in undefined behavior. - Bypassing Boundary Checks: In the function, since is an unsigned value, negative values are interpreted as huge unsigned values, thereby bypassing boundary checks. - Stack Buffer Overflow: In the function, the calculated data size is excessively large, leading to a stack buffer overflow. Impact Scope Impact: This vulnerability may lead to Remote Code Execution (RCE), depending on the memory protection mechanisms of the target architecture (such as stack canaries and ASLR). In Industrial Control Systems (ICS), a crash results in an immediate loss of communication and control capabilities. Trigger Conditions: 1. The target device runs OpENer and listens on the default ENIP TCP port (44818). 2. The attacker establishes a standard TCP connection and registers a session. 3. The attacker establishes a CIP connection (e.g., via forwarding). 4. The attacker sends a request where is deliberately set to 1 (becoming negative after subtracting the header length), accompanied by a large amount of forged path data. Remediation Recommendations: - Perform strict type checking and boundary validation on length parameters. - Avoid using unsigned shift operations; ensure all operations remain within safe bounds. - Add additional boundary checks in the and functions to prevent negative values from being interpreted as huge unsigned values. POC Code Server Log Output ```plaintext networkhandler: opened new TCP connection on fd 22 /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' /home/user/OpENer/source/src/encap/encap.c:195:76: runtime error: left shift of 128 by 24 places cannot be r

Goal Reached Thanks to every supporter — we hit 100%!

OpENer Integer Overflow Leading to Stack Buffer Overflow in CIP Message Router

More from this source