Heap Overflow in BOKS KSL Log Service

Executive Summary

This vulnerability exists in boks_ksllogsd where it accepts a checksum algorithm name in the MD field of an authenticated KSL start message. The issue is that while OpenSSL recognizes the digest name, the system does not verify if the value fits within a fixed 16-byte checksum context field before copying it. This allows an authenticated KSL client to provide an oversized digest name, leading to a heap-based buffer overflow.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a heap overflow in boks_ksllogsd due to improper validation of digest names in KSL start messages. Detection requires monitoring for unexpected heap corruption or crashes in the boks_ksllogsd process. Check logs for segmentation faults or memory corruption errors. Inspect network traffic for malformed KSL start messages with oversized MD fields.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access to the KSL service could exploit this to write beyond allocated heap memory, potentially causing crashes, data corruption, or arbitrary code execution. This could lead to service disruption or unauthorized access to sensitive data depending on the system's configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized access or data breaches, which are critical violations under GDPR and HIPAA. Organizations may face penalties or legal consequences if such incidents occur due to unpatched systems.

Useful 0 Not Useful 0

Mitigation Strategies

Apply vendor patches or updates addressing the checksum validation issue in boks_ksllogsd. Restrict network access to KSL services to trusted clients only. Monitor logs for unusual activity related to KSL start messages with oversized checksum algorithm names.

Useful 0 Not Useful 0