GHSA-pmg7-7q9m-mx35: Out-of-bounds read in Zephyr HTTP client debug logging of response header fields
The HTTP client's debug helper printheaderfield() in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s conversion: snprintk(output, len + 1, "%s", str). The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not NUL terminated. The size argument of snprintk() bounds only the destination, while the %s conversion measures the source first — lib/os/cbprintfcomplete.c uses strlen() when no precision is given, and lib/os/cbprintfnano.c uses strlen() unconditionally — so the read walks past the end of the header field and past the end of the receive buffer until it finds a zero byte.
The slice reaches the helper from onurl(), onheaderfield() and onheadervalue(), which the parser invokes on bytes that httpwaitdata() read straight off the socket into the application-supplied recvbuf. A malicious or compromised HTTP server, or an attacker able to answer a plaintext request, therefore controls both the header field and the bytes that follow it in the buffer, and can guarantee that no zero byte appears before the buffer ends, forcing the over-read. The in-tree tests/net/lib/httpclient suite reproduces the over-read under CONFIGASAN=y on an ordinary GET.
The impact is bounded. The whole helper body is compiled only when the HTTP client log module is explicitly set to Debug (CONFIGNETHTTPLOGLEVELDBG=y, which the global CONFIGLOGDEFAULTLEVEL does not set), so default builds are unaffected. No out-of-bounds write occurs and none of the over-read bytes are emitted into the log, so there is no information disclosure; the consequence is an out-of-bounds read that can fault and panic the device where the buffer abuts an unmapped or MPU/MMU-protected region.
The fix copies exactly the len bytes the parser offered with memcpy() and terminates them, instead of relying on a %s conversion (a %.s precision would not have sufficed, since cbprintfnano.c measures the source in full before applying it).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the HTTP client Debug log module to prevent compilation of the vulnerable debug helper; the vulnerable code is compiled only when CONFIG_NET_HTTP_LOG_LEVEL_DBG=y.
Zephyr HTTP client CONFIG_NET_HTTP_LOG_LEVEL_DBG = disabled
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using Zephyr's HTTP client with debug logging that make requests to a malicious or compromised HTTP server are exposed. An attacker able to answer a plaintext HTTP request can also supply the crafted response.
What does an attacker need to do to trigger the over-read?
The attacker needs to return HTTP response header data that lacks a zero byte before the end of the application-supplied receive buffer. The HTTP parser passes those non-NUL-terminated slices to the debug helper, causing its %s formatting to read beyond the slice and buffer.
What is the immediate mitigation if patching is not possible?
Do not enable or use the affected HTTP client debug logging when processing responses from untrusted servers. Avoid plaintext HTTP where an attacker can answer or interfere with requests.