Null Pointer Dereference in S2OPC Server

Executive Summary

This vulnerability is a null pointer dereference in the S2OPC library version 1.7.3 or earlier. It occurs in the function msg_subscription_publish_bs__alloc_notification_message_items() when a failed memory allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions handling both notification types, causing the server process to terminate.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered by heap allocation failures during specific operations. Monitor S2OPC server logs for crashes or NULL pointer dereference errors during sessions handling both data-change and event notifications. Check for process termination events in system logs when both notification types are active.

Useful 0 Not Useful 0

Impact Analysis

The primary impact is denial of service as the server process crashes due to the null pointer dereference. This affects systems using S2OPC for OPC UA communication, potentially disrupting operations dependent on real-time data exchange or event notifications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing server processes, which could disrupt operations handling sensitive data. While not directly violating GDPR or HIPAA, such disruptions may impact availability requirements for systems processing personal or health data, potentially leading to compliance gaps if service continuity is not maintained.

Useful 0 Not Useful 0

Mitigation Strategies

Update S2OPC to a patched version (post-1.7.3) that fixes the NULL dereference issue. If immediate update is not possible, restrict sessions to either data-change or event notifications to prevent the triggering condition. Monitor server stability closely.

Useful 0 Not Useful 0