Bug 2284252 (CVE-2024-36843) - CVE-2024-36843 libmodbus: heap overflow
Summary: CVE-2024-36843 libmodbus: heap overflow
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2024-36843
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2284253 2284254
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-06-02 14:14 UTC by ybuenos
Modified: 2024-07-17 16:16 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-07-17 16:16:27 UTC
Embargoed:


Attachments (Terms of Use)

Description ybuenos 2024-06-02 14:14:14 UTC
libmodbus v3.1.6 was discovered to contain a heap overflow via the modbus_mapping_free() function.

https://github.com/stephane/libmodbus/issues/748

Comment 1 ybuenos 2024-06-02 14:14:33 UTC
Created libmodbus tracking bugs for this issue:

Affects: epel-all [bug 2284254]
Affects: fedora-all [bug 2284253]

Comment 2 Eric Sandeen 2024-07-17 16:16:27 UTC
This has been fixed since 3.1.7, see https://github.com/stephane/libmodbus/issues/748

b4ef4c17d618eba0adccc4c7d9e9a1ef809fc9b6 is the first bad commit
commit b4ef4c17d618eba0adccc4c7d9e9a1ef809fc9b6
Author: Michael Heimpold <mhei>
Date:   Sat Jan 8 20:00:50 2022 +0100

    modbus_reply: fix copy & paste error in sanity check (fixes #614)
    
    While handling MODBUS_FC_WRITE_AND_READ_REGISTERS, both address offsets
    must be checked, i.e. the read and the write address must be within the
    mapping range.
    
    At the moment, only the read address was considered, it looks like a
    simple copy and paste error, so let's fix it.
    
    Signed-off-by: Michael Heimpold <mhei>

 src/modbus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

version 3.1.7 is in EPEL8, EPEL9, Fedora 39, and Fedora 40, so no current releases are affected. Closing NOTABUG because it has already been fixed.


Note You need to log in before you can comment on or make changes to this bug.