Stack Buffer Overflow in COVESA Open1722

COVESA Open1722 versions up to 0.9.2 contain a critical stack-based buffer overflow vulnerability in the avtp_to_can() function. The vulnerability is triggered when the software processes a crafted UDP datagram containing more than 15 ACF-CAN messages. The implementation incorrectly increments the write index for a fixed 15-slot stack array without performing bounds checking against the caller-supplied array size.

Because the library listens for datagrams from any sender that matches a hardcoded, unauthenticated stream ID transmitted in plaintext, an attacker on the local network segment can send malicious packets to the listener. Successful exploitation allows for the corruption of adjacent stack memory, leading to a crash (denial of service) or the potential for arbitrary code execution in the context of the process running Open1722. This issue is particularly relevant to automotive networking components utilizing the IEEE 1722 protocol standard.

Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to crash systems using Open1722 or potentially gain execution privileges on the host. This poses a significant risk to in-vehicle networking and automotive infrastructure where IEEE 1722 implementations are deployed.

Recommendation

• Upgrade to a patched version of the Open1722 library immediately upon availability.
• Implement network-level segmentation to restrict UDP traffic directed at the Open1722 listener to known, authorized sources only.
• Monitor network traffic for malformed IEEE 1722 (AVTP) datagrams containing an abnormally high count of ACF-CAN messages that exceed standard operational thresholds.