Description

A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tcp/fsw/src/sbn_tcp_if.c of the component SBN TCP Module. Such manipulation of the argument MsgSz leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-30T06:16:55.450Z",
  "pubdate": "2026-08-30T06:16:55.450Z",
  "executiveSummary": "A buffer overflow vulnerability exists within the SBN TCP Module of NASA cFS up to version 7.0.1.\nThe vulnerability originates from improper handling of the MsgSz argument during the OS_read function execution within the module's protocol handling logic.\nAn attacker with network access to the local segment can exploit this flaw to trigger a buffer overflow, potentially leading to arbitrary code execution, system instability, or denial of service.\nThis vulnerability is critical due to the potential for memory corruption within the core Flight System (cFS) architecture.\nExploitation requires the attacker to be positioned within the local network to interface with the SBN TCP Module.\nThe vendor has been notified of the vulnerability but has not provided a response or remediation at this time.",
  "technicalDetails": "The vulnerability resides in the modules/protocol/tcp/fsw/src/sbn_tcp_if.c file, specifically within the OS_read function, which serves as the primary interface for processing incoming TCP packets in the SBN (Software Bus Network) TCP component.\nThe root cause is an insecure handling of the MsgSz parameter, which dictates the length of data read from the socket into a predefined buffer.\nDuring packet processing, the function fails to perform adequate bounds checking on the length of the data being read relative to the size of the destination buffer allocated for the TCP payload.\nAn attacker can exploit this by crafting a malicious TCP packet with a manipulated MsgSz field that exceeds the stack or heap buffer capacity. By sending this malformed packet, the attacker triggers an out-of-bounds write operation.\nThe attack flow proceeds as follows: First, the attacker establishes a connection to the SBN TCP listening port. Second, the attacker transmits a packet where the header field corresponding to MsgSz is set to a value significantly larger than the intended buffer size. Third, the OS_read function, failing to validate this length against the buffer's capacity, copies the incoming network data into the buffer memory space. This results in the overwriting of adjacent memory blocks, which may include function return addresses, saved registers, or critical data structures.\nSuccessful exploitation allows for the alteration of the application's control flow, potentially enabling an attacker to redirect execution to malicious code segments or payload payloads injected into the network stream.\nThis vulnerability is limited to the local network context, as the SBN TCP Module is typically configured for internal communication between cFS nodes. However, in environments where the network is not segmented or secured, this exposure is significant.\nThe impact includes system crashes, loss of control over flight software, or potential remote code execution depending on the memory layout and the specific target configuration of the cFS instance.\nThe vulnerability affects all versions of NASA cFS up to and including 7.0.1, specifically targeting the SBN TCP integration layer."
}