Memory Exhaustion Vulnerability in MOOS-IvP pMarineViewer

MOOS-IvP pMarineViewer, an application typically used for marine autonomy and visualization, contains a vulnerability in how it handles NODE_REPORT messages. The application fails to enforce limits on the number of tracked node identities processed by the system. An attacker with access to the MOOS publish/subscribe communication bus can inject a large volume of crafted NODE_REPORT messages, each containing a unique node name. This action forces the application to allocate memory for every distinct identity reported. Continued injection leads to significant memory exhaustion, eventually causing the operator display to stall or crash. This issue is particularly critical in systems where pMarineViewer is used for mission-critical situational awareness. The vulnerability affects all versions up to and including 24.8.1.

Impact

Successful exploitation results in a denial-of-service condition for the pMarineViewer operator display. In the context of marine robotic missions, this prevents operators from receiving real-time situational awareness, potentially leading to the loss of control or monitoring of autonomous assets. The vulnerability is unauthenticated and impacts the core visualization utility of the MOOS-IvP software suite.

Recommendation

Prioritized actions for security teams:

• Inventory systems running MOOS-IvP and identify instances of pMarineViewer version 24.8.1 or earlier.
• Implement network-level or middleware access controls to restrict access to the MOOS publish/subscribe communication bus, preventing unauthorized entities from injecting arbitrary NODE_REPORT messages.
• Prioritize the deployment of updates provided by the MOOS-IvP maintainers that implement validation and limiting logic on node identity tracking.