Stack Overflow in SpaceDot AcubeSAT OBC Software

Executive Summary

This is a stack-based buffer overflow in the AcubeSAT On-Board Computer (OBC) software. The vulnerability occurs in the loadRawData function when processing ECSS telecommand messages. A fixed 256-byte stack buffer is used but the dataLength parameter is not validated, allowing attackers to write beyond buffer limits. This can corrupt stack data including return addresses.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unexpected crashes or reboots in the AcubeSAT OBC software, particularly after receiving ECSS PUS Service 6 Subtype 2 telecommands. Check for stack corruption indicators like corrupted return addresses or key pointers in crash logs. Inspect network traffic for oversized payloads in ECSS TC messages targeting the loadRawData function.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to cause a Denial of Service by crashing the system or potentially achieve arbitrary code execution. The attack can be performed remotely or via adjacent network access through USART or CAN bus interfaces. Exploitation may lead to system compromise or information disclosure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's security rules for protected health information. A successful exploit could allow attackers to execute arbitrary code, potentially accessing or exfiltrating sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Apply input validation to ensure dataLength does not exceed 256 bytes in the loadRawData function. Implement bounds checking in Message::readOctetString and etl::array::operator[]. Disable or restrict access to USART and CAN bus interfaces if not required. Update to a patched version of the AcubeSAT OBC software if available.

Useful 0 Not Useful 0