NULL Pointer Dereference in GOOSE/R-GOOSE Shared Parser

Executive Summary

This vulnerability is a NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser. It allows a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame with a malformed TLV value.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for malformed GOOSE frames. Use network traffic analyzers like Wireshark to capture and inspect GOOSE traffic for malformed TLV values. Check application logs for crashes or errors related to GOOSE parsing. Ensure your GOOSE-capable devices are configured to log parsing errors.

Useful 0 Not Useful 0

Impact Analysis

The impact includes application crashes when processing malformed GOOSE frames. Since the attack is network-adjacent, it requires proximity to the target network. The CVSS score indicates high availability impact (VA:H in v4.0, A:H in v3.1).

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial-of-service condition by crashing subscribing applications, which could disrupt critical operations. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, it could affect the availability of electronic protected health information systems, potentially breaching Security Rule requirements for integrity and availability.

Useful 0 Not Useful 0

Mitigation Strategies

Apply vendor patches or updates for GOOSE parsing components. Isolate GOOSE traffic to trusted networks to limit exposure. Configure intrusion detection systems to alert on malformed GOOSE frames. Review and update GOOSE application configurations to handle malformed inputs gracefully.

Useful 0 Not Useful 0