Heap Out-of-Bounds Read in µD3TN Fragmenter

Executive Summary

This vulnerability is a heap out-of-bounds read in the µD3TN BPv6/BPv7 fragmenter. It occurs when a large fragment_offset near 2^64 wraps around due to uint64_t arithmetic, bypassing bounds checks. This causes the fragmenter to read memory before the payload buffer during copying, potentially exposing heap data or crashing the process.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual memory access patterns or crashes in the µD3TN daemon. Check logs for heap out-of-bounds read errors or process terminations. Use tools like gdb to attach to the µD3TN process and inspect memory access during bundle processing. Monitor network traffic for malformed BPv6/BPv7 fragments with crafted fragment_offset values near 2^64.

Useful 0 Not Useful 0

Impact Analysis

The impact includes information disclosure of adjacent heap memory and potential denial-of-service via process termination. An attacker could exploit this to read sensitive data or crash the system by sending a bundle with a crafted offset.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable external dispatch in µD3TN if enabled, or ensure a dispatcher secret is set to prevent unauthorized offset manipulation. Update to a patched version that validates fragment_offset and fragment_length to prevent wrap-around. Restrict network access to trusted peers only to limit exposure.

Useful 0 Not Useful 0