Vulnerability Summary: minmea Buffer Overflow Vulnerability Overview Vulnerability Type: Buffer Overflow Description: A validation function exists that restricts overflow bytes to printable ASCII characters (0x20-0x7E), making RCE non-trivial to achieve. Affected Component: Attack Type: Context-dependent Impact: Denial of Service (DoS) Attack Vectors: - GPS receiver parses NMEA sentences from an untrusted source. - Attacker spoofs GPS signals or performs a MITM attack. - Malicious NMEA sentences contain an overly long field 4, causing a stack buffer overflow in the application. Scope Affected Product Codebase: minmea A11 Specific Version: kosma minmea 0.3.0 Details: An issue was discovered in kosma minmea 0.3.0. The format specifier in the function copies NMEA field data into a caller-provided buffer, which can lead to a stack buffer overflow. Remediation Reference: https://github.com/kosma/minmea/blob/master/minmea.c#L231-L240 POC Code ```c >> [Vulnerability Type] >> Buffer Overflow >> [Additional Information] >> There is a validation function (minmea_isfield) that >> restricts it so that the overflow bytes must only be >> printable ASCII (0x20-0x7E), so RCE is not trivial >> [Affected Component] >> minmea.c >> [Attack Type] >> Context-dependent >> [Impact Denial of Service] >> true >> [Attack Vectors] >> 1. GPS receiver parses NMEA sentences from an untrusted >> source 2. Attacker spoofs GPS signal or performs MITM on >> serial line 3. Malicious NMEA sentence contains overly long >> field 4. Application's stack buffer overflows >> [Discoverer] >> David Williams >> [Reference] >> https://github.com/kosma/minmea/blob/master/minmea.c#L231-L240 >> [Vendor of Product] >> kosma >> [Affected Product Code Base] >> minmea A11 >> An issue was discovered in kosma minmea 0.3.0. The minmea_scan functions format specifier copies NMEA field data to a caller-provided buffer, which can lead to a stack buffer overflow.