PX4 Netman Stack Buffer Over-read Vulnerability Analysis and Fix (PR #28483)

Vulnerability Summary Vulnerability Overview Type: Stack Buffer Over-read Location: Root Cause: In the function, the buffer can only hold 80 bytes (including the terminating NUL), but the content written to via may exceed 80 bytes in length, causing to read uninitialized stack memory. Trigger Condition: When the interface name length is ≥ 74 bytes, reads stack memory beyond the declared range of . Impact Scope Affected Component: module ( / commands) Affected Platforms: PX4/NutIX targets with enabled Impact: - Stack memory leak to the console ( ) - Stack memory leak to the persistent network configuration file ( ) - Potential process crash or system instability (over-read beyond valid memory boundaries) Fix PR #28483: Fix Details: Added a length check for the interface name in the function to prevent over-read caused by overly long interface names. Status: Merged, committed by , reviewed and approved by . POC Code POC for Triggering the Over-read Expected Output (Stack Memory Leak to Console) ``` $ netman show -i AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA NETMAN-253,259,258 NETMAN-253,259,258 NETMAN-253,259,258 NETMAN-253,259,258 NETMAN-253,259,258 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258

Goal Reached Thanks to every supporter — we hit 100%!

PX4 Netman Stack Buffer Over-read Vulnerability Analysis and Fix (PR #28483)

More from this source