GHSA-gmhw-vmwr-wrxh: ION-DTN 3.6.2-4.2.0 Heap Buffer Overflow via nm_mgr AMP Rendering
NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nmmgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocations through unbounded strcat operations. Attackers can transmit oversized AMP reports, tables, or macros over the UDP CLA/AMP path or trigger the flaw locally via interactive UI rendering to crash nmmgr and cause a denial of service halting telemetry collection and operator visibility.
Affected Software
Event History
Frequently Asked Questions
Which systems have a remote attack path?
Systems running nm_mgr that accept AMP traffic over the UDP CLA/AMP path are exposed to remotely supplied oversized AMP reports, tables, or macros. The issue can also be triggered locally through interactive UI rendering.
Does remote exploitation require authentication or user interaction?
The supplied CVSS vector indicates no privileges are required and no user interaction is needed. An attacker needs to send deeply nested or oversized AMP content that reaches the vulnerable nm_mgr rendering logic.
What is the immediate operational impact of a successful trigger?
The out-of-bounds write can crash nm_mgr, causing a denial of service. This halts telemetry collection and removes operator visibility.