IEC 61850 Protocol Stack Memory Safety Vulnerabilities Fix Advisory

Vulnerability Overview This version (1.6.2) contains multiple vulnerability and bug fixes, primarily addressing issues related to memory safety, protocol handling, and cryptographic authentication. Affected Scope MMS Connection: Missing checks in may lead to Out-of-Bounds (OOB) reads. MMS Server: - Usage of association-specific datasets when updating URCB may lead to Use-After-Free (UAF). - Null pointer dereference. - Alternating access to components may cause stack overflow. - Infinite loop in ACSE parameter user information parsing. - Writing excessively large RPTIDs to RCB may trigger invalid writes. - Potential crash in access control check processing. - Server-side double free in MMS Get-File service. - MMS File Service initial position accepts unverified file sizes. - Incorrect message boundaries in ACSE. SV Subscriber: - Missing null terminators in and overlay tags may lead to OOB writes. - Missing length validation in certain ASDU elements may lead to OOB reads. R-Session: - Configured payload buffer sizes exceeding 65,000 bytes may lead to OOB writes. - Missing checks to prevent the field from containing extremely large payload length fields in messages. - Errors in signature verification. - Signature verification skipped when signature check is disabled. - Missing length validation when parsing v1 and v2 session protocol messages. - Missing encryption check when Protocol Version 1 is rejected. - Missing check for sending pre-write messages. ISO Presentation: - Missing length field validation may lead to OOB reads. - Incorrect buffer location validation checks may lead to OOB reads. COTP: - Missing NULL pointer and parameter size reasonableness checks. - Potential OOB in calls. BerDecoder: - Avoid integer and shift operation overflows. - Infinite recursion in GOOSE subscriber parsing of may cause stack overflow. - Memory leak in . Dynamic Model Generator: - Boolean value handling errors in Java and .NET dynamic model generators. - Missing length checks and message validation. - Modified server-side and GOOSE publishing timeout handling. - Added support for request timeout configuration. - Fixed to prevent duplicate reports triggered by boolean value updates. - Fixed value loading in . Remediation MMS Connection: Fixed missing checks in . MMS Server: - Avoided using association-specific datasets when updating URCB. - Fixed null pointer dereference. - Fixed stack overflow caused by alternating component access. - Fixed infinite loop in ACSE parameter user information parsing. - Fixed writing of excessively large RPTIDs to RCB. - Fixed potential crash in access control check processing. - Fixed server-side double free in MMS Get-File service. - Fixed MMS File Service initial position verification. - Fixed incorrect message boundaries in ACSE. SV Subscriber: - Fixed missing null terminators in and overlay tags. - Fixed missing length validation in certain ASDU elements. R-Session: - Fixed configured payload buffer size. - Fixed missing check to prevent field issues. - Fixed errors in signature verification. - Fixed skipping signature verification when signature check is disabled. - Fixed missing length validation when parsing v1 and v2 session protocol messages. - Fixed missing encryption check when Protocol Version 1 is rejected. - Fixed missing check for sending pre-write messages. ISO Presentation: - Fixed missing length field validation. - Fixed incorrect buffer location validation checks. COTP: - Fixed missing NULL pointer and parameter size reasonableness checks. - Fixed potential OOB in calls. BerDecoder: - Avoided integer and shift operation overflows. - Fixed infinite recursion in GOOSE subscriber parsing of . - Fixed memory leak in . Dynamic Model Generator: - Fixed boolean value handling in Java and .NET dynamic model generators. - Fixed missing length checks and message validation. - Modified server-side and GOOSE publishing timeout handling. - Added support for request timeout configuration. - Fixed to prevent duplicate reports triggered by boolean value updates. - Fixed value loading in . POC Code or Exploit Code No specific POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

IEC 61850 Protocol Stack Memory Safety Vulnerabilities Fix Advisory

More from this source