Snap7 Out-of-Bounds Write Vulnerability in TSnap7Peer NegotiatePDULength Function

A security vulnerability allowing for an out-of-bounds write has been identified in Snap7 versions prior to 1.4.3. The issue arises in the TSnap7Peer::NegotiatePDULength function within the file src/core/s7_peer.cpp. The vulnerability is triggered by manipulating the PDULength argument, leading to an out-of-bounds write. This flaw can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability causes a remote denial-of-service condition by crashing the client process. It also leads to heap corruption within the client object, causing undefined behavior by disrupting adjacent object members. In certain builds and memory layouts, more severe consequences may be possible.

Reproduction

The vulnerability can be reproduced by building the Snap7 client with AddressSanitizer enabled, which will detect memory corruption issues. After compiling the client, a mock server can be set up to negotiate a PDU length of 65535 bytes, which exceeds the client's payload capacity. When the client subsequently sends a write request, the negotiated length is trusted without validation, causing an intra-object heap overflow by writing 65000 bytes into a buffer that can only hold 4096 bytes. This overflow corrupts the client's object state, leading to a crash.

Remediation

To address this vulnerability, the negotiated PDU length should be capped at the maximum allowable size before it is accepted. Additionally, a bounds check should be implemented in the opWriteArea function to ensure that the data being written does not exceed the capacity of the payload buffer.