buglwIP - A Lightweight TCP/IP stack - Bugs: bug #60717, SNMPv3: Signed integer overflow...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60717: SNMPv3: Signed integer overflow after 68 years

Submitter:  Tim Schendekehl <timschendekehl>
Submitted:  Tue 01 Jun 2021 09:46:16 AM UTC
   
 
Category:  apps Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  git head

Tue 01 Jun 2021 09:46:16 AM UTC, original submission:  

Function snmp_parse_inbound_frame in file src/apps/snmp/snmp_msg.c contains a check for the engine time:
  if (request->msg_authoritative_engine_time > (time + 150)) {

After SNMP_MAX_TIME_BOOT seconds (68 years) the engine time will be reset to zero and the boot count will be increased. The last 150 seconds before that happens, there will be a signed integer overflow and SNMP packets will be rejected. Note that msg_authoritative_engine_time and time are signed 32-bit integers. Of course it is unlikely, that a device is running for so long without reboot.

Tim Schendekehl <timschendekehl>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by timschendekehl (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code