libsmi Out-of-Bounds Write in smiValueAsString

Executive Summary

libsmi through 0.5.0 has an out-of-bounds write flaw in the smiValueAsString() function in lib/smi.c. The function uses a fixed 1024-byte static buffer to render SMI values into strings. When processing OCTET STRING values with non-printable bytes, it converts them to hexadecimal encoding. The loop writing the hex representation lacks bounds checking, allowing attackers to overflow the buffer by supplying a crafted MIB file with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte. This corrupts adjacent library globals and can crash applications like smidump.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause crashes in applications that use libsmi, such as smidump, by corrupting memory. While it does not directly enable arbitrary code execution, the corruption of library globals may lead to denial-of-service conditions or unexpected behavior in dependent tools. Users processing crafted MIB files with long OCTET STRING values are at risk.

Useful 0 Not Useful 0