microcoap COAP library NULL pointer dereference vulnerability, root cause, fix, and PoC

Vulnerability Summary Vulnerability Overview Type: Segmentation fault (null pointer dereference) Affected Version: CoAP library ( function) Repository: https://github.com/1246/microcoap.git Commit: Root Cause: When processing requests, the code iterates through to find the option with a value of . Upon finding it, the code calls directly without checking if the pointer is NULL. When is NULL (which can be caused by zero-length options, malformed messages, or insufficient data), dereferences a null pointer, triggering a segmentation fault. Scope of Impact Trigger Scenarios: 1. Zero-length options: The behavior of in is undefined and may return NULL. 2. Malformed messages: Options are declared but data is insufficient, resulting in the pointer of some options being NULL. 3. Insufficient data: The message declares options but lacks sufficient data. Crash Location: around lines 665–670. Remediation Add a NULL pointer check before calling : Alternative (also checks minimum length): POC / Exploitation Code Using the command line: This malformed COAP packet content: Header: Version: 1, Type: 1, Token Length: 3, Option Count: 5 Code: Message ID: 8326 The header declares 5 options, but a payload marker ( ) follows immediately after the token, resulting in the pointer of some options being NULL. When the server processes this message and searches for the option, it crashes due to a null pointer dereference. Crash Stack Trace (excerpts): ``` AddressSanitizer: SEGV on unknown address 0x000000000000 pc 0x55f3288440 sp 0x7ffd31881113 AddressSanitizer: SEGV on unknown address 0x000000000000 pc 0x55f3288440 sp 0x7ffd31881113 #0 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #1 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #2 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #3 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #4 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #5 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #6 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #7 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #8 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #9 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #10 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #11 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #12 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #13 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #14 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #15 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #16 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #17 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #18 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #19 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #20 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #21 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #22 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #23 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #24 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #25 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #26 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #27 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #28 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #29 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #30 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #31 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #32 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #33 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #34 0x55f3288440 in coap_server_handle_session /home/1246/microcoap/coap/lib/coap/server.c:668 #35 0x55f3288440 in coap_server_handle_session /h

Goal Reached Thanks to every supporter — we hit 100%!

microcoap COAP library NULL pointer dereference vulnerability, root cause, fix, and PoC

More from this source