S2OPC 1.7.3 OPC UA Client Alarm Conditions OOB Read Vulnerability Analysis

Vulnerability Overview Title Client alarm_conditions out-of-bounds read via PublishResponse EventFieldList count mismatch #18 Abstract A client-side out-of-bounds read vulnerability has been discovered in the A&C event management wrapper path of S2OPC 1.7.3. A malicious OPC UA server or a man-in-the-middle can tamper with the server-to-client PublishResponse traffic by increasing the value for the first real event and appending an additional Null Variant. The S2OPC client alarm wrapper subsequently uses this remote field count as a loop bound, reading memory beyond the local pointer array. The out-of-bounds value is then used as a string path, which is resolved via the event manager's dictionary lookup, resulting in a reproducible client crash. Versions Affected Version: 1.7.3 Observed Source Code Commit: b4c5c7d3c696984615f14d905a7c92b3c377c4 Security Impact A remote attacker controlling the OPC UA server, or a man-in-the-middle modifying valid PublishResponses, can cause the S2OPC client process to crash when the client uses the official wrapper API. Current evidence supports a reliable Remote Denial of Service (DoS). Demonstrated primitives include: Remotely controlled loop boundaries Local pointer array out-of-bounds read Reuse of invalid pointers as string paths Crash upon downstream dereference Full ASan [Click here to view ASan] Affected Paths Primary Vulnerable Logic Downstream Crash Paths Callback Chain Sample Entry Points Root Cause Short Form The vulnerability is caused by a trust boundary violation: 1. The local count of select clause paths stored in . 2. The value in the received of the . The client builds a fixed local pointer array when creating the monitored item but later uses the event field count provided by the server as the loop boundary to decode event fields. The code does not verify that remains within . Detailed Explanation During alarm monitored item creation, the wrapper constructs the event filter locally and allocates a clause pointer array based on the number of variables in the local alarm event model. The relevant logic is as follows: 1. Retrieve the local alarm event instance. 2. Calculate the number of variables using . 3. Allocate . 4. Populate it via . 5. Store the resulting length in . Thus, the local array length is fixed by the client model at the time of monitored item creation. Later, when processing publish notifications, the wrapper callback receives an and iterates over events. For each event, it iterates over fields using the remote count: Field 0 is treated specially as the . For all other fields, the field is mapped back to a local string path using: However, there is no bounds check to ensure: Once the server inflates beyond the number of known select clauses plus the special slot, the client reads beyond the local pointer array. The vulnerability becomes externally visible because the out-of-bounds read value is not just read and discarded. It is passed as a string path to the event manager's path resolution code: At this point, the garbage pointer obtained from the out-of-bounds read is dereferenced as a C string, causing a crash. Observed Debugger Values The following values were captured in GDB at the point of the out-of-bounds read: This is the critical mismatch: = 48 = 46 Loop index = 47 Array index used is = 46 Valid indices are only 0..45 Therefore, the client is about to read , which is a genuine out-of-bounds access. PoC PoC.zip Reproduction Build Run Official Alarm Demo Server Expected startup output: Run Minimally Mutated Proxy for a Real PublishResponse Observed proxy behavior: Handshake and session creation pass through normally. Subscription and monitored item creation succeed. is issued normally. The proxy waits for the first containing event data. It then increases the field count of the first event and appends an additional Null Variant. Representative proxy output: Run Official Client Wrapper Sample Observations Results Analysis This indicates: 1. The official server started normally. 2. The client completed the normal wrapper workflow. 3. The proxy mutated only one carrying event data. 4. The crash occurred in the wrapper's event notification processing path. 5. The failed access was a read. 6. The downstream crash path is consistent with the garbage pointer being used as a string key. Remediation Recommendations Remediation Strategy The notification path should not blindly trust . A robust fix should do the following: 1. Reject events if exceeds the local known field budget. 2. Re-check the array index before accessing . The invariant for the wrapper is: where field 0 is the special slot. Suggested Patch The following is a minimal defensive patch for : Conclusion This is a genuine client-side memory safety vulnerability in the wrapper of S2OPC 1.7.3. The issue is caused by a lack of bounds checking when mapping a remotely provided invalid event field count to a locally allocated clause pointer array. The result is a reproducible out-of-bou

Goal Reached Thanks to every supporter — we hit 100%!

S2OPC 1.7.3 OPC UA Client Alarm Conditions OOB Read Vulnerability Analysis

More from this source