GHSA-c4q6-7827-mfg6: BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects the official apps/epics client tool before versions 1.4.5, 1.5.1, and 1.6.0. It does not affect the generic BACnet ReadPropertyMultiple-ACK decoder alone.
What does an attacker need to exploit this?
An attacker needs to act as, or control, a BACnet/IP endpoint that can send a reply to the EPICS tool's legitimate ReadPropertyMultiple request. Exploitation requires user interaction because the EPICS tool must issue that request.
How can I determine whether a system is exposed?
Check whether the deployment uses the official apps/epics tool and is running a version earlier than 1.4.5, 1.5.1, or 1.6.0. Systems that only use the generic RPM ACK decoder are not affected by this specific flaw.
What should be done if the affected tool is in use?
Update to version 1.4.5, 1.5.1, or 1.6.0, which contain the patch. Until updating, avoid accepting ReadPropertyMultiple-ACK responses from untrusted BACnet/IP endpoints when using the EPICS tool.