CVE-2025-30216: CryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header Length
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a Heap Overflow vulnerability occurs in the CryptoTMProcessSecurity function (cryptotm.c:1735:8). When processing the Secondary Header Length of a TM protocol packet, if the Secondary Header Length exceeds the packet's total length, a heap overflow is triggered during the memcpy operation that copies packet data into the dynamically allocated buffer pnewdecframe. This allows an attacker to overwrite adjacent heap memory, potentially leading to arbitrary code execution or system instability. A patch is available at commit 810fd66d592c883125272fef123c3240db2f170f.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CryptoLibto a version that resolves this vulnerability.Fixed in 1.3.3Patch 810fd66d592c883125272fef123c3240db2f170f - Configuration
In Crypto_TM_ProcessSecurity (crypto_tm.c:1735:8), add/ensure a bounds check so that when processing the Secondary Header Length of a TM protocol packet, if it exceeds the packet's total length, the function does not proceed to the memcpy that copies packet data into the dynamically allocated buffer p_new_dec_frame.
CryptoLib (Crypto_TM_ProcessSecurity / crypto_tm.c) Secondary Header Length validation = Reject/handle packets where Secondary Header Length exceeds packet total length before memcpy
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30216?
The severity of CVE-2025-30216 is classified as critical due to the potential for remote code execution via heap overflow.
How do I fix CVE-2025-30216?
To fix CVE-2025-30216, upgrade CryptoLib to version 1.3.4 or later, which addresses the heap overflow vulnerability.
What versions of CryptoLib are affected by CVE-2025-30216?
CryptoLib versions 1.3.3 and prior are affected by CVE-2025-30216.
What kind of vulnerability is CVE-2025-30216?
CVE-2025-30216 is a heap overflow vulnerability found in the CryptoLib implementation of the CCSDS Space Data Link Security Protocol.
Can CVE-2025-30216 be exploited remotely?
Yes, CVE-2025-30216 can be exploited remotely, allowing attackers to execute arbitrary code in the context of the application.