Description

A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/cFS/cfe/modules/sb/fsw/src/cfe_sb_util.c of the component cFE Software Bus. Performing a manipulation of the argument TotalMsgSize/HdrSize results in integer underflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-30T06:16:56.730Z",
  "pubdate": "2026-08-30T06:16:56.730Z",
  "executiveSummary": "A critical integer underflow vulnerability has been identified in the NASA cFS software framework, specifically within the cFE Software Bus (SB) component.\nThe flaw resides in the CFE_SB_GetUserDataLength function located in src/cFS/cfe/modules/sb/fsw/src/cfe_sb_util.c.\nThe vulnerability occurs due to improper handling of the TotalMsgSize and HdrSize parameters, leading to an integer underflow condition during message length calculation.\nThis flaw affects NASA cFS versions up to 7.0.1.\nThe vulnerability is exploitable remotely, posing a significant risk to the integrity and reliability of flight software systems.\nSuccessful exploitation could lead to undefined behavior, potential memory corruption, or system instability, depending on how the resulting underflow value is subsequently utilized by the message processing logic.\nThe vendor has not provided a response or an official patch for this disclosure, necessitating manual intervention by system maintainers to mitigate potential exploitation risks.",
  "technicalDetails": "The vulnerability is rooted in the CFE_SB_GetUserDataLength function within the cFE Software Bus component of the NASA cFS framework. The function is designed to calculate the length of the user data payload contained within a software bus message. The core logic performs an arithmetic subtraction of HdrSize from the TotalMsgSize argument provided to the function.\nThe flaw manifests when the TotalMsgSize parameter is numerically smaller than the HdrSize constant. Because these values are typically processed as unsigned integers, the subtraction operation triggers an integer underflow. Instead of producing a negative value, the operation wraps around to a very large positive integer, significantly exceeding the intended memory bounds of the message structure.\nThe attack flow involves an adversary crafting a malformed software bus message with a TotalMsgSize that is smaller than the expected header length. By injecting this specifically structured message into the system, the attacker forces the CFE_SB_GetUserDataLength function to return a mathematically incorrect, excessively large value for the message payload length.\nThis resultant integer, now representing a massive size, is subsequently used by the cFS Software Bus to allocate memory, copy data, or perform bounds checks. When the software subsequently attempts to read from or write to the memory location based on this inaccurate length value, it triggers a heap-based buffer overflow or an out-of-bounds memory access.\nGiven that the cFE Software Bus is a central communication mechanism, this vulnerability allows for remote exploitation, provided the attacker can reach the message ingestion interface. The absence of input validation before the arithmetic operation allows an attacker to bypass critical system safety checks.\nImpact of successful exploitation includes potential memory corruption, arbitrary code execution, or a total system crash (Denial of Service). As the underlying system is flight software, such failures can lead to loss of mission-critical functionality. Because the product version up to 7.0.1 is affected and no vendor patch currently exists, systems relying on this component remain vulnerable until custom source-code modifications are implemented to validate the arithmetic bounds before the subtraction occurs."
}