GHSA-c9pq-93jp-w649: Out of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messages
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2025‑55093 |
Severity |
Medium |
CWE |
|
Published |
2025‑10‑17 |
Last updated |
2025‑10‑17 |
Description
IPv4 processing contains code that will process DHCP unicast messages when the interface IP address is zero. In this case it will read the port from the UDP packet. In order to do that, it will perform an in-place byte swap to deal with big endian data encoding. There is no bounds check to ensure there is a UDP header inside of the IP payload. If an attacker sends a malicious IP packet with a protocol set to UDP, but no actual content, then the code will corrupt 4 bytes of memory.
code:
threadx\netxduo-master\common\src\nx_ipv4_packet_receive.c
VOID _nx_ipv4_packet_receive(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
{
...
/* Try to receive the DHCP message before release this packet.
NetX should receive the unicast DHCP message when interface IP address is zero. */
/* Check if this IP interface has IP address. */
else if (if_ptr -> nx_interface_ip_address == 0)
{
/* Determine what protocol the current IP datagram is. */
protocol = ip_header_ptr -> nx_ip_header_word_2 & NX_IP_PROTOCOL_MASK;
/* Check if this packet is UDP message. */
if (protocol == NX_IP_UDP)
{
/* Remove the IP header from the packet. */
packet_ptr -> nx_packet_prepend_ptr = packet_ptr -> nx_packet_prepend_ptr + sizeof(NX_IPV4_HEADER);
/* Adjust the length. */
packet_ptr -> nx_packet_length = packet_ptr -> nx_packet_length - (ULONG)sizeof(NX_IPV4_HEADER);
...
udp_header_ptr = (NX_UDP_HEADER *)packet_ptr -> nx_packet_prepend_ptr;
...
NX_CHANGE_ULONG_ENDIAN(udp_header_ptr -> nx_udp_header_word_0); // <-- there is no bounds check prior to this code. This could corrupt memory.
...
}
...
}
...
}