Out-of-Bounds Read in SpaceDot AcubeSAT OBC Software

Executive Summary

This is an out-of-bounds read vulnerability in the AcubeSAT On-Board Computer (OBC) software. It occurs in the CAN::Application::parsePerformFunctionMessage function which processes CAN bus messages. The function uses a fixed loop of 32 iterations to read bytes from a message without checking if the payload has enough data. When the payload is shorter than 32 bytes, the function reads beyond valid data into residual memory, potentially exposing sensitive information or enabling further attacks.

Useful 0 Not Useful 0

Detection Guidance

Monitor CAN bus traffic for messages with messageType 3 (PerformFunction) and payloads shorter than 32 bytes. Use tools like Wireshark with CAN protocol dissectors or custom scripts to inspect message lengths and detect anomalies in message parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to information disclosure by leaking sensitive memory contents, denial of service by consuming CPU cycles and saturating message queues, logic injection by passing residual data as command parameters, or privilege escalation through chained exploitation with other vulnerabilities like stack overflows.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to information disclosure by leaking sensitive memory contents, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information. The potential for logic injection or privilege escalation could also undermine access control measures mandated by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the AcubeSAT OBC software to a patched version that validates payload length before processing. Implement input validation for CAN messages to ensure payloads meet minimum length requirements. Restrict CAN bus access to trusted devices only.

Useful 0 Not Useful 0