CFDP Protocol Resource Exhaustion via Replayed EOF (PoC Analysis)

Vulnerability Overview Title: [SECURITY] CFDP finished transactions remain re-matchable in holdover allowing resource exhaustion via replayed EOF #1075 Description: Issue: In CFDP (File Delivery Protocol), completed transactions are not immediately removed from the active transaction lookup structures; instead, they are converted to the state. If the same pair replays the final PDU later (with the same and ), the lookup logic still matches the old transaction, re-triggering , leading to resource exhaustion. Specific Manifestation: - marks the transaction as completed and sets it to , but does not remove it from the active lookup structures. - continues to search for activity in RX/PEND/TX queues based on attacker-controlled and . - The path processes matched, replayed EOF/FIN traffic for these transactions. Impact Scope Resource Exhaustion: An attacker can inject or replay CFDP PDUs to , keeping logically completed transactions in a re-matchable state, thereby causing resource exhaustion. Security-Critical Decision: The system has already made a security-critical decision that, although transactions are completed, the completion objects remain reachable and alive until unused replay traffic triggers them. Remediation Expected Behavior: Once a received transaction is logically completed, it should no longer be possible to match the old transaction via replayed final PDUs (with the same and ) to extend its residency duration. Recommended Fix: - Remove completed transactions from the active lookup structures. - Alternatively, at minimum, do not allow replayed final PDU traffic to re-activate the holdover/inactive state. - Implement stricter handling for duplicate EOF/FIN traffic while in the state. POC Code Code Snippet System Observation Hardware: Containerized native example deployment Operating System: Linux (containerized native target) Version: Example deployment built from this repository using ; reproduced against in-tree example stack on July 9, 2026 Additional Context Most Accurate Description: - This is an externally triggerable transaction lifecycle/state machine consistency flow. - Dynamically proves that completed transactions remain re-matchable and resident. - Evidence supports transaction timeout delays and reduced channel capacity. - Should not be overstated, as it is not a memory corruption vulnerability. Current Dynamic Verification Has Proven the Following Lifecycle Chain in Example: - CFDP RX -> FinishTransaction -> HOLD -> replay EOF -> same transaction keeps matching Important Boundary Conditions Still Apply: - Actual risk depends on whether CF is enabled. - Whether external parties can reach the relevant CI_LAB/SB/CF_OH_RX entry points. - Whether an attacker can maintain injection or replay of the same transaction identifiers. - And whether mission deployments add additional rate limiting, replay filtering, or network isolation. Suggested Remediation Remove completed transactions from the active lookup structures. Alternatively, at minimum, do not allow replayed final PDU traffic to re-activate the holdover/inactive state. Implement stricter handling for duplicate EOF/FIN traffic while in the state. Reporter Information Draft prepared based on local source code review and dynamic reproduction.

Goal Reached Thanks to every supporter — we hit 100%!

CFDP Protocol Resource Exhaustion via Replayed EOF (PoC Analysis)

More from this source