buglwIP - A Lightweight TCP/IP stack - Bugs: bug #60717, SNMPv3: Signed integer overflow...


You are not allowed to post comments on this tracker with your current authentication level.

bug #60717: SNMPv3: Signed integer overflow after 68 years

Submitted by:  Tim Schendekehl <timschendekehl>
Submitted on:  Tue 01 Jun 2021 09:46:16 AM UTC
Category:  apps Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  * git head
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:
       No canned response available


Tue 01 Jun 2021 09:46:16 AM UTC, original submission:  

Function snmp_parse_inbound_frame in file src/apps/snmp/snmp_msg.c contains a check for the engine time:
  if (request->msg_authoritative_engine_time > (time + 150)) {

After SNMP_MAX_TIME_BOOT seconds (68 years) the engine time will be reset to zero and the boot count will be increased. The last 150 seconds before that happens, there will be a signed integer overflow and SNMP packets will be rejected. Note that msg_authoritative_engine_time and time are signed 32-bit integers. Of course it is unlikely, that a device is running for so long without reboot.

Tim Schendekehl <timschendekehl>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by timschendekehl (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    No changes have been made to this item

    Back to the top

    Powered by Savane 3.9