libIEC61850 vulnerabilities

libIEC61850 prior to 1.6.2 does not validate the length of the RptID field in the report-control-block write path, accepting values longer than 129 bytes. When a report is later serialized, the function passes the stack-backed buffer rptIdBuf[130] to MmsValue_setVisibleString, whose resize path frees that buffer, causing an invalid free and server crash.

In libIEC61850, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. This causes a stack buffer over-read and copies those bytes into the caller-owned listName buffer, potentially crashing the server on a defineNamedVariableList request.

In libIEC61850, the MMS file service accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer, disclosing prior response data and protocol fragments to an unauthenticated remote client. Fixed in 1.6.2.

libiec61850 version 1.6 contains a vulnerability in the parseGoosePayload() function in /goose/goose_receiver.c, allowing attackers to bypass authentication via a captured GOOSE frame.

In libIEC61850, parseUserInformation checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path swallows the error, reads buffer[-1], resets parsing, and repeats the same state, leading to an infinite CPU loop or an out-of-bounds read and process abort.

In libIEC61850 from 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes the file handle in a task but leaves a stale non-NULL value in a task marked as unused. If a later ObtainFile request reuses that task and destination creation fails, the cleanup path closes the stale FILE object again, allowing a remote crash of the server.

In libIEC61850, alternateArrayAccess does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can crash servers whose data models contain arrays. Fixed in 1.6.2.

In the MZ Automation libiec61850 library up to version 1.6.1, a heap-based buffer overflow vulnerability was found in the MmsMapping_varAccessSpecToObjectReference function in src/iec61850/common/iec61850_common.c of the MMS Protocol Workflow component. Manipulating the GetNamedVariableListAttributesResponse.itemId argument leads to overflow. The attack requires local access, and the exploit is public.

A heap-based buffer overflow vulnerability was found in MZ Automation libiec61850 up to 1.6.1 in the function SVReceiver_stopThreadless of src/sampled_values/sv_subscriber.c. The attack must be initiated locally and the exploit is public. Version 1.6.2 mitigates the issue.

Use-after-free vulnerability in MZ Automation libiec61850 up to 1.6.1, in the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c (URCB Revalidation component). The attack requires local access. The exploit has been made public. Upgrading to version 1.6.2 fixes the issue.

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. The function checkDataSetAccess in src/iec61850/server/mms_mapping/mms_mapping.c causes an out-of-bounds read. The attack can be initiated remotely. The exploit has been made public.

A heap overflow vulnerability was discovered in libiec61850 version 1.5 in the BerEncoder_encodeLength function at /asn1/ber_encoder.c. This flaw could allow an attacker to execute arbitrary code or cause a denial of service.