Out-of-Bounds Read/Write in SpaceDot AcubeSAT OBC

Executive Summary

This vulnerability is an out-of-bounds read/write issue in the AcubeSAT OBC software's MessageParser::parseECSSTCHeader function. It occurs when processing ECSS PUS telecommand messages via the CAN bus. The function uses a fixed 64-byte length without validating the actual payload size, causing it to read beyond the valid payload boundary in a 1024-byte buffer. This leads to reading residual data and embedding it into telecommand messages.

Useful 0 Not Useful 0

Detection Guidance

Monitor CAN bus traffic for malformed ECSS PUS telecommand messages with payloads exceeding 64 bytes. Use tools like Wireshark with CAN bus dissectors to inspect message lengths and payloads. Check for unexpected residual data in telecommand buffers or crashes in MessageParser::parseECSSTCHeader.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Denial of Service (DoS) by crashing the system. It may also enable arbitrary telecommand execution, information disclosure, logic injection, or remote code execution through chained attacks. The attack vector is via adjacent network access through the CAN bus, meaning an attacker must be on the same network segment.

Useful 0 Not Useful 0

Mitigation Strategies

Update the AcubeSAT OBC software to a patched version that validates payload lengths before processing. Implement input validation to reject messages with payloads larger than the internal buffer size. Restrict CAN bus access to trusted sources only.

Useful 0 Not Useful 0