PCAN Parser Stack-Based Buffer Overflow Due to Unchecked DLC

Executive Summary

This vulnerability involves a stack-based buffer overflow in the PEAK-System PCAN parser. The issue occurs when the parser uses an attacker-controlled DLC (Data Length Code) to index a length table without checking if DLC is within the valid range (0x0f or less). This allows copying attacker-controlled data from a specific offset into a fixed-size stack buffer, potentially leading to arbitrary code execution or system compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a stack-based buffer overflow due to improper handling of DLC values in the PEAK-System PCAN parser. Detection requires inspecting CAN device drivers and parser implementations for improper bounds checking on DLC values. Check for driver versions and updates from PEAK-System that address this issue.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to execute arbitrary code on the affected system. This might result in system crashes, unauthorized data access, or complete system takeover. Users of HMS Networks PEAK-System device drivers or PCAN Windows CAN device drivers are particularly at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local attackers to execute arbitrary code or cause denial-of-service via a crafted CAN message due to improper input validation. For compliance, it could violate data integrity and availability requirements under GDPR and HIPAA, as unauthorized code execution may lead to unauthorized access or data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update or patch the PEAK-System PCAN parser and related device drivers to ensure proper bounds checking on DLC values. Disable or restrict access to CAN devices if updates are unavailable. Monitor CAN traffic for unusual payload sizes or patterns.

Useful 0 Not Useful 0