GHSA-rcqq-5qmv-7fxp: ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR
NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgrreceive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
ION-DTN versions 2.2.1b through 4.2.0 are affected where the DGR convergence layer processes datagrams through the dgr_receive API. Exposure can include DGR traffic delivered through internal IPC or custom transports, not only externally sourced network traffic.
What must an attacker provide to trigger the memory corruption?
An attacker needs to supply a malicious datagram containing a crafted 64-bit svcDataLength value that causes the 32-bit allocation-size calculation to wrap. The subsequent unchecked memcpy can then write beyond the allocated heap buffer.
What is the potential impact of successful exploitation?
Successful exploitation can corrupt heap memory and cause a denial of service. The supplied information also identifies potential remote code execution as an outcome.