libiec61850 URCB Heap Use-After-Free Vulnerability Analysis

Vulnerability Overview Vulnerability Name: Server-Side Heap Use-After-Free in URCB Revalidation of Association-Specific Dynamic Datasets Across Connection #596 Vulnerability Type: Heap Use-After-Free Description: In libiec61850 version 1.6.1, when an association-specific dynamic dataset is bound to a URCB (Unreport Control Block), if a client with an MMS connection disconnects, and a subsequent connection reuses the same URCB and re-enables reporting, a server-side heap use-after-free vulnerability occurs. The issue stems from a lifecycle mismatch: the connection-scoped MMS NamedVariableList (backing dataset object) and the long-lived URCB runtime state ( ). In the vulnerable flow, the first client creates an association-specific dataset (e.g., ) and assigns it to the URCB. When the client disconnects, the server destroys the connection-owned and its internal heap strings. However, the URCB retains a dynamic dataset whose metadata aliases the already freed object. When another client later writes to the same URCB and reprocesses the report, compares the new name with the old and dereferences the freed heap memory (in ), causing a reproducible crash. Impact Scope Affected Versions: libiec61850 v1.6.1 Impact Type: Remote Denial of Service (RDoS) Specific Impact: Remote clients can trigger a server process crash, resulting in service interruption. Remediation Recommendations: Ensure that runtime DataSet metadata does not alias connection-owned memory. Deep copy all string metadata imported from the MMS NamedVariableList when creating the runtime DataSet. Specific Fix Steps: 1. Deep Copy Dataset Metadata: - When creating the runtime DataSet, deep copy all string metadata imported from the MMS NamedVariableList. - Example Code: 2. Ensure Freed Memory for Deep Copies: - Free the memory of these deep copies in . POC Code Building the Official Server and POC Client: Server: POC: ```bash clang -O1 -g -fno-omit-frame-pointer -fsanitize=address,undefined \ -poc.c \ -Iconfig -Ihal/inc -Isrc/common/inc -Isrc/mms/inc -Isrc/mms/inc_private \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:72:17 \ -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2282:17 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -Isrc/iec61850/inc -Isrc/iec61850/server/mms_mapping/reporting.c:2672:32 \ -Isrc/mms/axl -I

Goal Reached Thanks to every supporter — we hit 100%!

libiec61850 URCB Heap Use-After-Free Vulnerability Analysis

More from this source