ION-DTN (< 4.2.1-A.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ion-dtn--4.2.1-a.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 10 Sep 2026 17:07:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service in ION-DTN via Zero-Length Payloadhttps://feed.craftedsignal.io/briefs/2026-09-ion-dtn-dos/Thu, 10 Sep 2026 17:07:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-ion-dtn-dos/ION-DTN versions prior to 4.2.1-a.1 are vulnerable to a remote denial-of-service attack, allowing unauthenticated attackers to terminate the process by sending a malformed BPv7 bundle.ION-DTN versions prior to 4.2.1-a.1 contain a denial-of-service vulnerability triggered by improper input validation within the Bundle Protocol version 7 (BPv7) stack. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted BPv7 bundle containing a zero-length payload. The vulnerability resides in the canonicalizePayloadBlock() function located in bpsec_util.c, which passes the payload length to the zco_clone() function without verification. This lack of validation triggers a failed CHKZERO assertion, resulting in a call to sm_Abort() and the immediate termination of the ION process via a SIGABRT signal. Because the crash occurs before HMAC verification is performed, no valid credentials or keys are required to successfully trigger the service interruption, making the system highly susceptible to remote disruption.

Attack Chain

  1. Attacker identifies a network-exposed instance running an affected version of ION-DTN (< 4.2.1-a.1).
  2. Attacker prepares a malicious BPv7 bundle packet with a payload length field explicitly set to zero.
  3. Attacker transmits the malformed bundle over the network to the target ION-DTN service endpoint.
  4. The target system receives the packet and initiates processing within the Bundle Protocol (BP) stack.
  5. The canonicalizePayloadBlock() function processes the bundle and invokes zco_clone() with the unchecked zero-length value.
  6. The zco_clone() function triggers a CHKZERO assertion failure due to the invalid length.
  7. The process calls sm_Abort() and terminates abruptly via SIGABRT, resulting in a denial of service.

Impact

Successful exploitation results in the immediate, unauthenticated termination of the ION-DTN process. This impact is significant for mission-critical deployments using Delay-Tolerant Networking (DTN) protocols where uptime is essential for data relay operations. If exploited, the service remains offline until manual intervention restarts the process, potentially leading to critical data loss or communication outages across affected network nodes.

Recommendation

Prioritized actions for administrators of ION-DTN systems:

  • Upgrade all instances of ION-DTN to version 4.2.1-a.1 or later to remediate the vulnerability identified in CVE-2026-75584.
  • Implement network-level filtering to restrict access to ION-DTN services to known and trusted peer nodes to mitigate the impact of unauthenticated access.
  • Deploy monitoring systems to detect and alert on abnormal process termination events (e.g., SIGABRT) or unexpected service restarts in the ION environment.
]]>lowadvisorydenial-of-servicevulnerability