RTKLIB Off-by-One Buffer Overflow in RTCM3 SSR Decoding

Executive Summary

This vulnerability exists in RTKLIB through version 2.4.3 and is an off-by-one out-of-bounds read in the decode_ssr3 function located at src/rtcm3.c:1446.

It allows remote attackers to trigger a global buffer overflow by sending specially crafted RTCM3 SSR messages that contain attacker-controlled signal mode fields.

The vulnerability can be exploited remotely via malicious SSR correction streams sent over NTRIP or serial connections.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crafted RTCM3 SSR messages with attacker-controlled signal mode fields being sent over NTRIP or serial connections to RTKLIB-based systems.

Specifically, detection involves inspecting SSR correction streams for mode values that equal or exceed the constellation's code count, which triggers the off-by-one out-of-bounds read.

Commands to detect such malicious messages could include network traffic capture and analysis tools like tcpdump or Wireshark to filter and examine RTCM3 SSR messages on NTRIP or serial interfaces.

• Use tcpdump to capture NTRIP traffic: tcpdump -i <interface> port <NTRIP_port> -w capture.pcap
• Analyze captured packets with Wireshark, filtering for RTCM3 SSR messages and inspecting the signal mode fields for suspicious values.
• On serial connections, use tools like cat or screen to monitor incoming SSR correction streams and parse messages for mode field anomalies.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or filtering incoming SSR correction streams over NTRIP or serial connections to prevent malicious RTCM3 SSR messages from reaching RTKLIB-based systems.

Applying patches or updates to RTKLIB that fix the off-by-one error in the decode_ssr3 function is critical. The fix involves changing the guard condition to properly validate the mode field.

If patching is not immediately possible, consider disabling or limiting access to vulnerable RTKLIB services or rovers until a fix can be applied.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can cause denial of service or crash RTKLIB rovers and CORS servers.

Useful 0 Not Useful 0