漏洞概述 在S2OPC 1.7.3客户端包装器中，存在一个越界读取漏洞。当客户端发送一个包含一个监控项的 请求，但服务器返回的 响应中 被恶意修改为2时，客户端包装器会进入一个由服务器控制的循环，导致越界读取。 影响范围 客户端拒绝服务：恶意OPC UA服务器或中间人攻击者可以远程崩溃S2OPC客户端包装器应用程序。 可靠进程中止：在4秒内可靠地中止进程。 网络路径可达性：通过官方包装器示例可达。 修复方案 在索引任何请求侧数组之前，响应处理程序必须验证响应结果计数与保存的请求计数一致。具体修复代码如下： POC代码 以下是利用该漏洞的POC代码： 重现步骤 1. 构建： 2. 运行时假设： - 包装器客户端连接到代理端口4842 - 演示服务器监听在4841 - 使用未加密的SecurityPolicyNone演示配置 3. 终端1：启动官方服务器： 4. 终端2：启动篡改响应计数的代理： 5. 终端3：运行官方包装器示例： 预期结果 客户端首先正常行为，然后崩溃在库中： ``` Creation of subscription succeeded with revised parameters publish=500.000000 (lifetimeCount=keepAliveOpt=3. Creation of monitored item for node ns1;s=TestObject.Counter succeeded Value change notification for node ns1;s=TestObject.Counter: ... Value statuscode=0x00000000 Then it crashes in the library: ==24123==ERROR: AddressSanitizer: heap-buffer-overflow READ of size 4 at 0x602000000014 thread T1 #0 0x7f0c770258cf in start_thread /lib/x86_64-linux-gnu/libc.so.6+0x8b7 #1 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #2 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #3 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #4 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #5 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #6 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #7 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #8 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #9 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #10 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #11 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #12 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #13 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #14 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #15 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #16 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #17 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #18 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #19 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #20 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #21 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #22 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #23 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #24 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #25 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #26 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #27 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #28 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #29 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #30 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #31 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #32 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #33 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #34 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #35 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #36 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #37 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #38 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #39 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #40 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #41 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #42 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #43 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #44 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #45 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #46 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #47 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #48 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #49 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #50 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #51 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #52 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #53 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #54 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #55 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #56 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #57 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #58 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #59 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #60 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #61 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+0x122 #62 0x7f0c770258cf in clone /lib/x86_64-linux-gnu/libc.so.6+